Abstract: An information processing device includes processing circuitry configured to determine whether or not there is integrity in predetermined data regarding a boot sequence of an Operating System (OS) during execution of shutdown of the OS, arid suspend shutdown of the OS when it is determined that there is no integrity in the predetermined data.

Abstract: A generation device includes a memory, and processing circuitry coupled to the memory and configured to sense anomaly of a network based on information having a plurality of items related to communication in the network, identify a cause of anomaly corresponding to each piece of the information when anomaly is sensed, and generate, based on values of the items in the information and the cause of anomaly identified, a cause-of-anomaly pattern for each predetermined set of pieces of the information.

Abstract: An application operation control device includes processing circuitry configured to store associated file information that indicates, in association with each other, an application and an associated file that is a file whose integrity is to be verified when integrity of the application is determined, and associated application information that indicates, in association with each other, the application and an associated application that is an application that is potentially affected when the integrity of the application is damaged, determine integrity of the associated file of the application, and in a case where, among a plurality of the associated files of the application, integrity of any of the plurality of the associated files is determined to be damaged, extract, as a target application for operation control, an application associated with an associated file the integrity of which is determined to be damaged from the associated file information.

Abstract: An information creating device includes processing circuitry configured to identify, for a plurality of applications, one or more files that are accessed due to activation or operation of an application of the plurality of applications during the activation or the operation of the application, identify, for the plurality of applications, one or more other applications that transmit and receive data to and from the application, and store, in a memory, associated file information that indicates, for the plurality of applications, the one or more files accessed during the activation or the operation of the application as associated files of the application, and associated application information that indicates, for the plurality of applications, the one or more other applications that transmit and receive data to and from the application as associated application of the application.

Abstract: An anomaly detection device is provided with a learning unit that generates a detection model using a communication log during normal operation of a communication apparatus as learning data and an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model. The anomaly detection device is further provided with a data acquisition unit that acquires a communication log (second communication log) generated during a predetermined period later than a first communication log and a determination unit that instructs relearning using the second communication log when there is difference information between the learning data (first communication log) of the current detection model and the second communication log and when the number of pieces of additional information (information on the additional flow) or the number of pieces of deletion information (information on the delete flow) included in the difference information satisfies predetermined evaluation criteria.

Abstract: An update device includes processing circuitry configured to store package management information that includes associations between files and packages including the files and information indicating existence/non-existence of dependence relationships among the packages, and an access control list that includes associations between the files and access source files permitted to access the files, refer, when a combination of a file and an access source file is specified, to the package management information to identify a package including the file and a package including the access source file, and add, when the identified package including the file and the identified package including the access source file are the same or are mutually in a dependence relationship, the specified combination to the access control list.

Abstract: A communication system including an operational network including a host and a learning and detection server, and a staging network including a host of the same type as the host, a test execution server, and a learning and detection server. The test execution server performs a communication test by transmitting test communication in a normal state to the host and receiving communication performed by the host. The learning and detection server learns the communication of the host, generates an initial model for detecting an anomalous communication of the host, and transmits the initial model to the learning and detection server. The learning and detection server learns the communication of the host and generates a model for detecting an anomalous communication of the host, while monitoring the communication of the host using the initial model received from the learning and detection server.

Abstract: A verification information modification device includes processing circuitry configured to acquire, from each verification device that uses verification information of software to verify a file forming the software, an error log relating to erroneous detection that has occurred in the verification device, when it is determined that a same error has occurred in a predetermined number or more of verification devices based on the acquired error log, extract an error log of the error from acquired error logs and create information indicating verification information that has caused the erroneous detection and candidates for modification details of the verification information based on the extracted error log, and output the information indicating verification information that has caused the erroneous detection and candidates for modification details of the verification information.

Abstract: An information processing device includes processing circuitry configured to determine whether or not there is integrity in predetermined data regarding a boot sequence of an Operating System (OS) during execution of shutdown of the OS, arid suspend shutdown of the OS when it is determined that there is no integrity in the predetermined data.

Abstract: A storage unit stores a size of a free area of storage of target equipment, and software saved in the storage. The generation unit generates a graph including a number of nodes according to the size of the free area of the storage, and transmits the graph to the target equipment. The calculation unit calculates a hash value corresponding to each software block saved in the storage. The verification unit verifies the presence or absence of tampering of the storage of the target equipment using the hash value corresponding to the block calculated, a response calculated using the graph returned to a challenge that specifies a node of the graph, and a hash value corresponding to the block returned as the response to the challenge that specifies the block.

Abstract: A verification information creation apparatus acquires an installation directory of software from equipment on which the software is installed, and acquires a file path and a hash value of a file whose hash value is acquirable based on types of files stored in the acquired directory. Then, the verification information creation apparatus creates verification information about the software, where the verification information includes the acquired file path and the hash value of the file.

Abstract: A verification information creation apparatus includes an analysis section configured to acquire a file path and a hash value of a file to be checked using the hash value during verification of the file out of files contained in a software package by executing a predetermined command for the software package; and a verification information creation section configured to create verification information for software in the software package, the verification information including the file path and the hash value of the file, the file path and the hash value being acquired by the analysis section.

Abstract: An anomaly detection device includes a memory, and processing circuitry coupled to the memory and configured to acquire communication feature values of communication devices, calculate, for each transmission source MAC address included in the communication feature values acquired, a total value of the number of transmitted and received packets or a total value of the number of bytes, for each layer-2 switch connected to a corresponding communication device, and determine, for each transmission source MAC address, that a communication device corresponding to the transmission source MAC address is connected to a layer-2 switch whose total value of the number of transmitted and received packets or total value of the number of bytes calculated is the largest.

Abstract: An update device includes processing circuitry configured to store package management information that includes associations between files and packages including the files and information indicating existence/non-existence of dependence relationships among the packages, and an access control list that includes associations between the files and access source files permitted to access the files, refer, when a combination of a file and an access source file is specified, to the package management information to identify a package including the file and a package including the access source file, and add, when the identified package including the file and the identified package including the access source file are the same or are mutually in a dependence relationship, the specified combination to the access control list.

Abstract: An application operation control device includes processing circuitry configured to store associated file information that indicates, in association with each other, an application and an associated file that is a file whose integrity is to be verified when integrity of the application is determined, and associated application information that indicates, in association with each other, the application and an associated application that is an application that is potentially affected when the integrity of the application is damaged, determine integrity of the associated file of the application, and in a case where, among a plurality of the associated files of the application, integrity of any of the plurality of the associated files is determined to be damaged, extract, as a target application for operation control, an application associated with an associated file the integrity of which is determined to be damaged from the associated file information.

Abstract: An information creating device includes processing circuitry configured to identify, for a plurality of applications, one or more files that are accessed due to activation or operation of an application of the plurality of applications during the activation or the operation of the application, identify, for the plurality of applications, one or more other applications that transmit and receive data to and from the application, and store, in a memory, associated file information that indicates, for the plurality of applications, the one or more files accessed during the activation or the operation of the application as associated files of the application, and associated application information that indicates, for the plurality of applications, the one or more other applications that transmit and receive data to and from the application as associated application of the application.

Abstract: A generation device includes a memory, and processing circuitry coupled to the memory and configured to sense anomaly of a network based on information having a plurality of items related to communication in the network, identify a cause of anomaly corresponding to each piece of the information when anomaly is sensed, and generate, based on values of the items in the information and the cause of anomaly identified, a cause-of-anomaly pattern for each predetermined set of pieces of the information.

Abstract: An anomaly detection device is provided with a learning unit that generates a detection model using a communication log during normal operation of a communication apparatus as learning data and an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model. The anomaly detection device is further provided with a data acquisition unit that acquires a communication log (second communication log) generated during a predetermined period later than a first communication log and a determination unit that instructs relearning using the second communication log when there is difference information between the learning data (first communication log) of the current detection model and the second communication log and when the number of pieces of additional information (information on the additional flow) or the number of pieces of deletion information (information on the delete flow) included in the difference information satisfies predetermined evaluation criteria.

Abstract: An anomaly detection device includes a memory, and processing circuitry coupled to the memory and configured to acquire communication feature values of communication devices, calculate, for each transmission source MAC address included in the communication feature values acquired, a total value of the number of transmitted and received packets or a total value of the number of bytes, for each layer-2 switch connected to a corresponding communication device, and determine, for each transmission source MAC address, that a communication device corresponding to the transmission source MAC address is connected to a layer-2 switch whose total value of the number of transmitted and received packets or total value of the number of bytes calculated is the largest.

Abstract: A communication system including an operational network including a host and a learning and detection server, and a staging network including a host of the same type as the host, a test execution server, and a learning and detection server. The test execution server performs a communication test by transmitting test communication in a normal state to the host and receiving communication performed by the host. The learning and detection server learns the communication of the host, generates an initial model for detecting an anomalous communication of the host, and transmits the initial model to the learning and detection server. The learning and detection server learns the communication of the host and generates a model for detecting an anomalous communication of the host, while monitoring the communication of the host using the initial model received from the learning and detection server.