Abstract: A testing device (10) transmits a test packet that increases processing load to a device protected by a security system, the security system performing authentication of a packet transmitted to a to-be-protected device and a packet limit per source IP address. In addition, the testing device (10) generates a test session according to a scenario when transmitting the test packet and configures a packet so that the test packet uses a plurality of source IP addresses. In addition, the testing device (10) responds to a response request up to a predetermined stage of authentication among a plurality of stages of authentication performed by the security system so that the security system authenticates the test packet to be valid. In addition, the testing device (10) monitors, at a predetermined stage, packet filtering situation and processing load of the security system to which the test packet is transmitted.

Abstract: A test device includes processing circuitry configured to access a test target site managed by a test target device to acquire information on the test target site, and specify test settings for increasing a processing load of the test target device based on the information, manage session information of a test packet for increasing a processing load on the test target device, construct a test session with the test target device according to a scenario based on the test settings specified, and generate the test packet, and transmit the test packet for increasing the processing load to the test target device.

Abstract: A testing device (10) transmits a test packet that increases processing load to a device protected by a security system, the security system performing authentication of a packet transmitted to a to-be-protected device and a packet limit per source IP address. In addition, the testing device (10) generates a test session according to a scenario when transmitting the test packet and configures a packet so that the test packet uses a plurality of source IP addresses. In addition, the testing device (10) responds to a response request up to a predetermined stage of authentication among a plurality of stages of authentication performed by the security system so that the security system authenticates the test packet to be valid. In addition, the testing device (10) monitors, at a predetermined stage, packet filtering situation and processing load of the security system to which the test packet is transmitted.

Abstract: A detection apparatus includes processing circuitry configured to store attack information including detection time, attack attribute, and communication destination of a DDoS attack, and extract, from a collection of the attack information, a combination of the attack information according to the detection time, the attack attribute, and the communication destination as a coincident attack, an intermittent attack, or an identical target attack.

Abstract: An acquiring unit acquires a packet indicating flow information that is output by a network device at a predetermined sampling rate, and a determining unit determines as abnormal, for each of predetermined traffic patterns, when a sampling error rate is equal to or lower than a predetermined upper limit value and the number of packets acquired in a predetermined count period preceding from a current time or an average value of the number of packets per unit time is equal to or higher than a predetermined detection threshold.

Abstract: A monitoring device (10) monitors traffic of a network. The monitoring device (10) collects at least one of first information, which is information concerning a first packet transmitted to an address not used in the Internet, and second information, which is information concerning a second packet transmitted to a specific destination set as a decoy. The monitoring device (10) determines, based on information concerning the traffic monitored by the monitoring device (10) and the information collected by monitoring device (10), whether an attack occurs.

Abstract: A flow information analysis apparatus receives flow information containing a header sample, determines whether the header sample of the flow information matches any of templates that are based on tunneling protocols, and when determining that the header sample matches any of the templates, extract information on a header of the IP packet from the header sample on the basis of the matched template. Further, when determining that the header sample does not match any of the templates, the flow information analysis apparatus extracts information on the header of the IP packet from the header sample on the basis of a result of a search through the header sample for a byte sequence that matches search data in which a value that is set in a specific field of the tunnel header and a value that is set in a specific field of the IP packet are combined.

Abstract: A connection control apparatus is configured such that a connection count calculator calculates a TCP connection count, which is the number of TCP connections established between a server and one or more clients on a network, of each of servers on the network. The connection control apparatus is configured such that, when a determiner determines that the calculated count is larger than or equal to a predetermined threshold value, an anomalous connection detector detects anomalous connection, and a packet controller controls packet transmission and reception over the anomalous connection.

Abstract: An acquiring unit acquires a packet indicating flow information that is output by a network device at a predetermined sampling rate, and a determining unit determines as abnormal, for each of predetermined traffic patterns, when a sampling error rate is equal to or lower than a predetermined upper limit value and the number of packets acquired in a predetermined count period preceding from a current time or an average value of the number of packets per unit time is equal to or higher than a predetermined detection threshold.

Abstract: A flow information analysis apparatus receives flow information containing a header sample, determines whether the header sample of the flow information matches any of templates that are based on tunneling protocols, and when determining that the header sample matches any of the templates, extract information on a header of the IP packet from the header sample on the basis of the matched template. Further, when determining that the header sample does not match any of the templates, the flow information analysis apparatus extracts information on the header of the IP packet from the header sample on the basis of a result of a search through the header sample for a byte sequence that matches search data in which a value that is set in a specific field of the tunnel header and a value that is set in a specific field of the IP packet are combined.

Abstract: A connection control apparatus is configured such that a connection count calculator calculates a TCP connection count, which is the number of TCP connections established between a server and one or more clients on a network, of each of servers on the network. The connection control apparatus is configured such that, when a determiner determines that the calculated count is larger than or equal to a predetermined threshold value, an anomalous connection detector detects anomalous connection, and a packet controller controls packet transmission and reception over the anomalous connection.

Abstract: A log information collecting unit that collects log information and traffic information output from a plurality of communication devices included in a network; a normalization processing unit that normalizes the log information and traffic information collected by the log information collecting unit; a log information analysis processing unit that extracts, and analyzes according to a predetermined rule, relative log information and traffic information from the normalized log information and traffic information, and determines whether or not there is unauthorized access; and an event information notifying unit that outputs event information including information indicating importance based on a result of the determination by the log information analysis processing unit, are included.

Abstract: A log information collecting unit that collects log information and traffic information output from a plurality of communication devices included in a network; a normalization processing unit that normalizes the log information and traffic information collected by the log information collecting unit; a log information analysis processing unit that extracts, and analyzes according to a predetermined rule, relative log information and traffic information from the normalized log information and traffic information, and determines whether or not there is unauthorized access; and an event information notifying unit that outputs event information including information indicating importance based on a result of the determination by the log information analysis processing unit, are included.

Abstract: A repeater device receives from a first repeater device, which is adjacent to the repeater device on a network, a signature for controlling passage of a packet through the repeater device and determines whether to send the received signature to a second repeater device, which is adjacent to the repeater device on the network, based on contents of the received signature, and sends the received signature to the second repeater device when determining that the received signature is to be sent to the second repeater device.

Abstract: A repeater selecting unit selects at least one repeater that becomes a notification destination of route information for routing a malicious packet through a defense device, from among a plurality of repeaters adjacent to the defense device, based on the information on the attack. A route-information notifying unit notifies the route information for routing the malicious packet through the defense device to the selected repeater. A packet control unit controls a passage of the malicious packet routed to the defense device from the repeater to which the route information has been notified.

Abstract: A gas discharge display panel for a large screen display in which the display brightness and emission efficiency are very high, the display accuracy is high, and is simple to construct. Cathode electrodes having openings forming discharge cells are arranged in parallel on a front plate and a number of anode electrodes are arranged in parallel on a rear plate orthogonal to the cathode electrodes. Each opening in the cathode electrodes may be rectangular, substantially rectangular or circular. The length of one side of a rectangular opening or the diameter of a circular opening is set to satisfy 40.lambda..sub.e .ltoreq.D.ltoreq.500.lambda..sub.e while the thickness of the cathode electrode is 10.lambda..sub.e .ltoreq.T.ltoreq.100.lambda..sub.e, where .lambda..sub.e is the mean free path of electrons in a gas sealed in the display panel.

Abstract: A gas discharge display panel for a large screen display in which the display brightness and emission efficiency are very high, the display accuracy is high, and is simple to construct. Cathode electrodes having openings forming discharge cells are arranged in parallel on a front plate and a number of anode electrodes are arranged in parallel on a rear plate orthgonal to the cathode electrodes. Each opening in the cathode electrodes may be rectangular, substantially rectangular or circular. The length of one side of a rectangular opening or the diameter of a circular opening is set to satisfy 40.lambda..sub.e .ltoreq.D.ltoreq.500.lambda..sub.e while the thickness of the cathode electrode is 10.lambda..sub.e .ltoreq.T.ltoreq.100.lambda..sub.e, where .lambda..sub.e is the mean free path of electrons in a gas sealed in the display panel.

Abstract: A gas discharge display panel for a large screen display in which the display brightness and emission efficiency are very high, the display accuracy is high, and is simple to construct. Cathode electrodes having openings forming discharge cells are arranged in parallel on a front plate and a number of anode electrodes are arranged in parallel on a rear plate orthogonal to the cathode electrodes. Each opening in the cathode electrodes may be rectangular, substantially rectangular or circular. The length of one side of a rectangular opening or the diameter of a circular opening is set to satisfy 40.lambda..sub.e .ltoreq.D.ltoreq.500.lambda..sub.e while the thickness of the cathode electrode is 10.lambda..sub.e .ltoreq.T.ltoreq.100.lambda..sub.e, where .lambda..sub.e is the mean free path of electrons in a gas sealed in the display panel.