Abstract: A conversion device (10) analyzes an input packet and acquires header information included in the packet. Furthermore, the conversion device (10) classifies packets into one of a plurality of groups on the basis of the acquired header information and set grouping conditions. Subsequently, the conversion device (10) generates packets for analysis on the basis of the processing corresponding to the classified groups.

Abstract: A conversion device analyzes information of an input packet using hardware and determines whether to perform predetermined previous stage processing using the hardware. Furthermore, when it is determined to perform the previous stage processing, the conversion device uses the hardware to provide metadata including identification information indicating a group of packets to the packets on the basis of the fixed-length header information of the packets. In addition, the conversion device uses software to generate analysis packets corresponding to the group of packets using the provided metadata.

Abstract: An extraction unit extracts predetermined information from an outer header and an inner header of a tunneled packet passing through a network device in which congestion has occurred. An evaluation unit evaluates an order in which fine grain flows in a tunnel subdivided with reference to the extracted predetermined information are subject to TE, based on attribute information of the fine grain flows.

Abstract: A design apparatus optimizes, with a first granularity (for example, a real number solution), a traffic volume allocated to each of links between adjacent nodes included in a network. In addition, the design apparatus calculates an approximation solution obtained by approximating, with a second granularity (for example, an integer solution), the traffic volume having been optimized with the first granularity. Furthermore, the design apparatus maps logical paths to each of routes constituted by the links in accordance with the approximated traffic volume.

Abstract: A feature calculation unit calculates a feature of header information of a packet. A classification unit classifies the packet as a normal packet or an abnormal packet by using the calculated feature. An adding unit adds a label indicating a tool name of a known attack tool to header information of a packet attacked using the attack tool. A learning unit learns the addition of the label by using the label and the feature calculated for the packet to which the label has been added as teacher data.

Abstract: An emulation processor may be configured to support emulating unknown binary logic based on non-arbitrariness of the unknown binary logic. For example, an unknown binary logic signal may take the finite binary values of 0 and 1. The circuitry in the emulation processor is configured to generate and propagate outputs based on the interactions of known input binary signals with the unknown input binary signals having non-arbitrary states. The emulation processor may support the both combinational and sequential operations associated with the unknown binary logic.

Abstract: When the deletion unit deletes the outer header of the encapsulated packet, the outer header and a field containing information of the outer header are provided in the packet. In addition, when re-encapsulating a received packet, the addition unit adds an outer header to the packet by using information of the outer header extracted from the field.

Abstract: A detection device includes: a statistic unit that acquires statistical value data on 5-tuple flows in a certain time period; a degree centrality calculation unit that calculates a degree centrality of a node including an indegree, which is a total sum of a weight of each edge flowing into the node, and an outdegree, which is a total sum of a weight of each edge flowing out of the node, based on the statistical value data on the 5-tuple flows in the certain time period; and a degree centrality impartation unit that imparts the degree centrality, as a feature, to the statistical value data on the 5-tuple flows in the certain time period.

Abstract: A continuity checking apparatus generates a continuity checking packet to which a predetermined flag and user attributes are assigned and transmits the generated continuity checking packet to an edge router connected to a service that is an entrance of a service chain. Each service transmits an arrival message with respect to the continuity checking packet to the continuity checking apparatus upon reception of the continuity checking packet to which the predetermined flag is assigned. In addition, each service transfers the continuity checking packet to a next service device of the service chain on the basis of the user attributes assigned to the received continuity checking packet. The continuity checking apparatus identifies a path representing service devices through which the continuity checking packet passes on the basis of the arrival message transmitted from each service, and determines whether the identified path is the same as a path of the service chain that is a continuity checking target.

Abstract: The controller (10) acquires information about the band of the flow within the tunnel and the band of each flow after policing or shaping, calculates the ratio of the traffic volume after policing or shaping to the traffic volume before policing or shaping by using the acquired information about the band, and estimates the traffic volume of the flow to be monitored within the tunnel by using the calculated ratio and the band of each flow after policing or shaping.

Abstract: A detection device (10) includes: a statistic unit (131) that acquires statistical value data on 5-tuple flows in a certain time period; a degree centrality calculation unit (132) that calculates a degree centrality of a node including an indegree, which is a total sum of a weight of each edge flowing into the node, and an outdegree, which is a total sum of a weight of each edge flowing out of the node, based on the statistical value data on the 5-tuple flows in the certain time period; and a degree centrality impartation unit (133) that imparts the degree centrality, as a feature, to the statistical value data on the 5-tuple flows in the certain time period.

Abstract: A non-contact blood vessel analyzer includes an image acquisition device and an image processing device. The image acquisition device acquires an image which is a moving image or successive still images of a blood vessel. The image processing device detects a beat and a thrill from temporal change of an index derived from brightness and/or chromaticity of the image.

Abstract: A conversion device (10) includes a separation unit (11) that separates an inputted encapsulated packet into flow information and sampled headers including outer headers and inner headers, a decapsulation unit (12) that separates the outer headers from the sampled headers, and a conversion unit (13) that obtains statistics about the inner headers on the basis of the sampled headers separated from the outer headers, generates an xFlow packet including at least statistical information indicating the statistics about the inner headers, and outputs the generated xFlow packet to an external device.

Abstract: A handling apparatus (14a) handles a server attack taking place on a network (1Na) or handles a server attack as requested by a security system provided on another network. In accordance with a determination that it is not possible to handle the server attack by the handling apparatus (14a), the control determination apparatus (12a) makes a request to another security system (1Sb) capable of handling the server attack to handle the server attack. A centralized control apparatus (11) determines whether the server attack taking place on the network (1Na) can be handled on another network.

Abstract: A collection device (10) collects traffic from a core network (10N) connected to a plurality of operator networks (20N). Further, an analysis device has a plurality of functions of analyzing traffic. Further, a setting device sets a scenario that designates at least one of the plurality of functions. Further, a pre-processing device converts the traffic collected by the collection device (10) to traffic of a format suitable for the function designated by the scenario. Further, a distribution device distributes the traffic converted by the pre-processing device to a designated function.

Abstract: When receiving packets of a flow from a network device (1), a transmission control device (10) determines, according to processing abilities of flow collectors (20), rates in transmitting information concerning the flow to the collectors 20. The transmission control device (10) selects, based on header information of the received packets, the flow collector (20) to be a transmission destination of the information concerning the flow of the packets. The transmission control device (10) transmits the information concerning the flow at the rate determined for each of the flow collectors (20).

Abstract: The sorting unit (10) has a sorting function unit (13) that acquires a frame and a sorting key, embeds the sorting key in a header of the frame, and sorts the frame into a processing thread based on the value of the sorting key in the header.

Abstract: Embodiments disclosed herein describe systems and methods for tuning phases of interface clocks of ASICs in an emulation system for a low latency channel and to avoid read errors. During a bring-up time (e.g., powering up) of the emulation system, one or more training processors may execute a software application to iteratively tune the phases of the interface clocks such that data is written to the interface buffers prior to being read out. To mitigate the problem of higher latency, the training processors may execute software application to tune the clock phases such that there is a small time lag between the writes and reads. The training processors may set the time lag to account for factors such as memory setup and hold, clock skews, clock jitters, and the predicted margin required to account for future clock drift due to carrying operating conditions.

Abstract: An emulation processor may be configured to support emulating unknown binary logic based on non-arbitrariness of the unknown binary logic. For example, an unknown binary logic signal may take the finite binary values of 0 and 1. The circuitry in the emulation processor is configured to generate and propagate outputs based on the interactions of known input binary signals with the unknown input binary signals having non-arbitrary states. The emulation processor may support the both combinational and sequential operations associated with the unknown binary logic.

Abstract: A pseudorandom logic circuit may be embedded as a hardware within an emulation system, which may generate pseudorandom keephot instructions. A masking logic may mask out portions in each pseudorandom keephot instruction, which may change state elements during execution. A cluster of emulation processors may execute masked pseudorandom keephot instructions to consume power when not executing mission instructions. The cluster of emulation processors may run keephot cycles, during which the cluster of emulation processors may execute the pseudorandom keephot instructions causing the cluster of emulation processors to continue consuming a roughly constant amount of power, either at a same or different voltage level, but supposed outputs of the pseudorandom keephot instructions may have no impact upon inputs and outputs generated during mission cycles.