Abstract: A training data generating system includes an existing tag information acquiring unit, a target tag information acquiring unit, a selecting unit, and a training data generating unit. The existing tag information acquiring unit identifies, as an existing application, an application for which training data for a user operation model has already been generated based on a user operation history and, for each existing application, acquires tag information indicating a feature of the application as existing tag information. The target tag information acquiring unit acquires tag information of a target application as target tag information. The selecting unit calculates a degree of similarity between the target tag information and each piece of the existing tag information and, based on the degree of similarity, selects a similar application from the existing applications. The training data generating unit generates training data for the target application from training data for the similar application.

Abstract: An impact range estimation apparatus 10 estimates a range of impact due to infection by malware in a network system with a plurality of nodes. The impact range estimation apparatus 10 includes: a reverse propagation probability calculation unit 11 configured to, when a specific node is infected with the malware, based on scenario information that specifies a pattern of attack by the malware and a communications log in the network system before infection by the malware, for each node other than the specific node, calculate a probability that the malware propagates from that other node to the specific node; and a simulation execution unit 12 configured to, using the calculated probability, execute a plurality of times a simulation in which the malware is propagated to the specific node, and for each other node, calculate a number of times that that node becomes a propagation source of the malware.

Abstract: The communication terminal detects a functional module of anomalous operating state, and to notify the edge server of the anomalous operating state. The edge server generates respective disk images corresponding to the functional module and a related functional module, generates a plurality of divided disk images obtained by dividing the generated disk image, and sends the plurality of divided disk images to the storage device. The storage device stores the divided disk images, and sends divided disk images corresponding to the functional module and the related functional module to the communication terminal in response to request from the communication terminal. The communication terminal generates the disk image by coupling the plurality of divided disk images acquired from the storage device, and turns on the functional module and the related functional module based on the generated disk image.

Abstract: Provided is a network control device 2000 for controlling a network where a plurality of terminals and countermeasure devices are connected, the network control device 2000 including: a clustering unit 2001 that divides terminals including an incident-detected terminal and the related terminal group into a plurality of zones, on the basis of terminal information including information with which an incident-detected terminal is able to be identified, information with which a related terminal group suspected of being related to an incident is able to be identified among the plurality of terminals, and an inter-terminal communication history; and a communication control setting unit 2002 that sets communication control relating to the terminals and the countermeasure devices for each of the plurality of zones.

Abstract: A log generation apparatus includes: a log classifying unit that classifies log data formed of a plurality of logs into groups based on log types; a statistical model generating unit that performs, for each of the groups, a conversion of the logs classified into the group into events that are each formed of two or more logs, and further generates a statistical model by calculating, for each of the events obtained by the conversion, an appearance probability of the event based on the times of occurrence of the event and the number of instances of the event; and a log information generating unit that selects a specific event in accordance with the appearance probabilities of the events in the statistical model and generates new logs, or log information for generating the new logs, using text data that corresponds to the selected event and that has been prepared beforehand.

Abstract: Provided is an incident effect range estimation device which estimates the range of the effect of an incident and shortens incident handling time. This incident effect range estimation device is provided with an incident origin log acquisition unit which acquires log information for the incident-originating device which is related to the occurrence of the incident, a communication destination log acquisition unit which acquires, on the basis of the log information for the incident-originating device, log information for a communication destination device which is the communication destination of the incident-originating device, and an effect range estimation unit which estimates the range of the effect of the incident on the basis of the communication destination device. The range of the effect of the incident can thereby be estimated automatically, and thus incident handling time can be shortened significantly.

Abstract: An impact range estimation apparatus 10 estimates a range of impact due to infection by malware in a network system with a plurality of nodes. The impact range estimation apparatus 10 includes: a reverse propagation probability calculation unit 11 configured to, when a specific node is infected with the malware, based on scenario information that specifies a pattern of attack by the malware and a communications log in the network system before infection by the malware, for each node other than the specific node, calculate a probability that the malware propagates from that other node to the specific node; and a simulation execution unit 12 configured to, using the calculated probability, execute a plurality of times a simulation in which the malware is propagated to the specific node, and for each other node, calculate a number of times that that node becomes a propagation source of the malware.

Abstract: Provided is a communication information integration system 1 in which a communication information integration apparatus 3 classifies collected first communication information for each terminal apparatus 4, generates summary information summarizing the classified communication information corresponding to the terminal 4, and transmits the generated summary information to the corresponding terminal apparatus 4, the terminal apparatus 4, upon receiving the summary information, extracts a difference between the first communication information and second communication information collected by the terminal apparatus 4, using the second communication information and the summary information, generates difference communication information based on the extracted difference, and transmits the generated difference communication information to the communication information integration apparatus 3, and the communication information integration apparatus 3, upon receiving the difference communication information from the te

Abstract: An information processing apparatus (2000) acquires state information representing states of persons, for a first person and a second person associated with the first person. The information processing apparatus (2000) determines whether a predetermined condition regarding states of the first person and the second person is satisfied, by using state information of the first person and state information of the second person. The information processing apparatus (2000) sends a notification of recommending at least the first person to take a break when the predetermined condition is satisfied.

Abstract: Provided is a network control device 2000 for controlling a network where a plurality of terminals and countermeasure devices are connected, the network control device 2000 including: a clustering unit 2001 that divides terminals including an incident-detected terminal and the related terminal group into a plurality of zones, on the basis of terminal information including information with which an incident-detected terminal is able to be identified, information with which a related terminal group suspected of being related to an incident is able to be identified among the plurality of terminals, and an inter-terminal communication history; and a communication control setting unit 2002 that sets communication control relating to the terminals and the countermeasure devices for each of the plurality of zones.

Abstract: Provided is an incident effect range estimation device which estimates the range of the effect of an incident and shortens incident handling time. This incident effect range estimation device 10 is provided with an incident origin log acquisition unit 11 which acquires log information for the incident-originating device which is related to the occurrence of the incident, a communication destination log acquisition unit 12 which acquires, on the basis of the log information for the incident-originating device, log information for a communication destination device which is the communication destination of the incident-originating device, and an effect range estimation unit 13 which estimates the range of the effect of the incident on the basis of the communication destination device. The range of the effect of the incident can thereby be estimated automatically, and thus incident handling time can be shortened significantly.