Abstract: A communication terminal apparatus includes processing circuitry configured to collect communication of an application and control the communication of the application based on a first control condition, analyze the communication collected to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

Abstract: A technique for efficiently registering local models in a local model management table used when a global model is computed from local models in federated learning is provided. A secure global model computation device in a federated learning system including M local model training devices for training local models using training data and a secure global model computation system composed of N secure global model computation devices for secure computation of a global model from M local models includes a parameter share registration unit that receives shares of parameters of an m-th local model trained by an m-th local model training device (where m satisfies 1?m?M)) as an input and register the shares of the parameters of the m-th local model in a local model management table using K records having a set (m, k) of identifiers and shares of parameters of a k-th layer (1?k?K) of the m-th local model as one record.

Abstract: Provided is a technique for efficiently receiving a local model required for computation of a global model in federated learning. A secure global model computation device in a federated learning system including M local model learning devices for learning local models using training data and a secure global model computation system composed of N secure global model computation devices for performing secure computation of a global model from M local models includes a processing vacancy checking unit configured to check whether or not the N secure global model computation devices have processing vacancy when a processing vacancy check request transmitted by one of the M local model learning devices is received and to transmit a local model transmission instruction to the local model learning device and enter a reception waiting state when all of the N secure global model computation devices have processing vacancy.

Abstract: A technique for efficiently training a model by providing a function of training a local model by a device constituting a secure computation system for computing a global model in a federated learning.

Abstract: A model learning device obtains information that specifies an aggregate model or confidential information of the information that specifies the aggregate model from a secure federated learning device, updates the aggregate model through machine learning using local learning data to obtain a worker model, and obtains and provides confidential information of information that specifies the worker model to the secure federated learning device. A secure federated learning device obtains confidential information of information that specifies a plurality of worker models from a plurality of model learning devices, and obtains and provides, to the plurality of model learning devices, confidential information of information that specifies an aggregate model that is an aggregation of the plurality of worker models without obtaining the plurality of worker models through secure computation using the obtained confidential information.

Abstract: A computing device serving as a node of a blockchain executes processing for obtaining consensus using a consensus algorithm of the blockchain, and stores, in a block of the blockchain, a one-way function value of at least one of secret information obtained by securely distributing information based on original information and a secure computation result obtained by performing secure computation on the secret information in a case in which the consensus is obtained using the consensus algorithm of the blockchain.

Abstract: A method and circuitry to calculate a simultaneous linear equation with a plurality of symmetric positive definite matrices as coefficients. N symmetric positive definite matrices A˜ and N vectors B are input to input circuitry. Initialization circuitry initializes secret values of matrices X, R, and P and a vector ??. First calculation circuitry collectively calculates N matrix calculations to generate a secret value of a vector ??. Second calculation circuitry updates the secret value of the matrix X. Third calculation circuitry collectively calculates N matrix calculations to update the secret value of the matrix R. Fourth calculation circuitry collectively calculates an inner product of N vectors to generate a secret value of the vector ??. Fifth calculation circuitry updates the secret value of the matrix P, and sixth calculation circuitry collectively calculates the inner product of the N vectors and updates the secret value of the vector ??.

Abstract: Provided are a learning system and the like that significantly shorten a search time of NAS and enable machine learning in a practical time. The learning system includes a learning server apparatus and n processing apparatuses i. The processing apparatus i includes a score calculation unit that calculates a score sir when local data di is applied to each of A neural networks r. The learning server apparatus includes an aggregation unit that aggregates A neural networks using A×n scores sir and selects an optimal neural network. The first federated learning unit and the second federated learning units of the n processing apparatuses i cooperate to perform federated learning using the selected optimal neural network as a first global model. The score sir includes an index with which a neural network having an excellent learning effect can be searched for.

Abstract: A distributed learning technology that can accelerate convergence while ensuring security is provided. A learning step of generating, by an i-th client, a model ?wi,j in a j-th cycle using learning data Di, an aggregation step of generating, by a server, a global model ?wg,j in the j-th cycle from the models ?w1,j, . . . , ?wN,j in the j-th cycle according to a predetermined formula, and an end condition determination step of, by the server, ending learning processing with the global model ?wg,j in the j-th cycle as the global model ?wg in a case where a predetermined end condition is satisfied, and otherwise, transmitting the global model ?wg,j in the j-th cycle to the i-th client, and an initialization step of setting, by the i-th client, the global model ?wg,j in the j-th cycle as an initial value of a model ?wi,j+1 in a j+1-th cycle are included.

Abstract: A detecting device includes a memory, and processing circuitry coupled to the memory and configured to collect communication information from a communication device, have a model learn a characteristic of the communication information by the communication device using the communication information collected for each of the communication devices, and input communication information on a detection target to the model, detect whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model, and have the model relearn at the learning when the number of detected abnormalities about the communication information during a predetermined evaluation period exceeds a first threshold value.

Abstract: An analysis device includes processing circuitry configured to acquire, from each network traffic sensor that monitors communication of an Internet of Things (IoT) device, a normal communication model that is used for monitoring the communication and indicates a characteristic of normal communication of the IoT device, cluster a normal communication model group of a same feature among acquired normal communication model groups, calculate a majority cluster that is a cluster having a largest number of normal communication models by using a result of the clustering, and calculate an average model of the normal communication model group belonging to the majority cluster, and notify the network traffic sensor serving as an acquisition source of the normal communication model of attribution information indicating whether or not the normal communication model belongs to the majority cluster and the average model.

Abstract: A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.

Abstract: In a communication network system (1), each of a plurality of management devices (20) generates an individual whitelist, which is individually generated in each of a plurality of management devices (20), and is related to a communication destination of an IoT device (30A) connected to an own management device, and uploads a generated individual whitelist to a server device (10), the server device collects the plurality of individual whitelists uploaded from each of the plurality of management devices (20), generates an aggregated whitelist that is an aggregated result of the plurality of individual whitelists, and distributes the generated aggregated whitelist to each of the plurality of management devices (20), and each of the plurality of management devices (20) acquires the aggregated whitelist distributed from the server device (10), and updates the individual whitelist generated by an own management device based on the aggregated whitelist.

Abstract: Provided is an IoT GW (10), including a learning unit (131) configured to create, for each IoT device connected to the IoT GW (10), a normal communication model (122) that has learned a normal communication pattern of the IoT device; and a determination unit (132) configured to: determine, for learning by the learning unit (131), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit (131) based on a result of determination.

Abstract: A determination apparatus according to a first embodiment collects information regarding communication performed by an IoT device. The determination apparatus extracts patterns used for detecting unauthorized communication performed by the IoT device from information that has been collected. Also, the determination apparatus approximates a change in the cumulative value of the number of patterns to a function that expresses a predetermined curve, thereby calculating the degree of convergence of the change. Also, the determination apparatus determines whether or not the degree of convergence is no less than a predetermined value.

Abstract: A communication control apparatus includes a collection control unit, an analysis unit, and a coordination unit. The collection control unit collects communication performed with a device connected to a subordinate network, and controls communication performed by the device based on a first control condition; The analysis unit analyzes the communication collected by the collection control unit to extract device identification information indicating characteristics of the communication performed by the device. The analysis unit specifies a device name of the device and the first control condition corresponding to a normal communication range extracted from the device identification information, based on the device identification information.

Abstract: Provided is an IoT GW (10), including a learning unit (131) configured to create, for each IoT device connected to the IoT GW (10), a normal communication model (122) that has learned a normal communication pattern of the IoT device; and a determination unit (132) configured to: determine, for learning by the learning unit (131), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit (131) based on a result of determination.

Abstract: A communication terminal apparatus includes processing circuitry configured to collect communication of an application and control the communication of the application based on a first control condition, analyze the communication collected to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

Abstract: A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.

Abstract: A determination apparatus according to a first embodiment collects information regarding communication performed by an IoT device. The determination apparatus extracts patterns used for detecting unauthorized communication performed by the IoT device from information that has been collected. Also, the determination apparatus approximates a change in the cumulative value of the number of patterns to a function that expresses a predetermined curve, thereby calculating the degree of convergence of the change. Also, the determination apparatus determines whether or not the degree of convergence is no less than a predetermined value.