Abstract: A device for manufacturing a SiC substrate, in which the occurrence of a work-affected layer is reduced, or from which a work-affected layer is removed, comprises: a main container which can accommodate a SiC substrate and which generates, by heating, a vapor pressure of a vapor-phase species including elemental Si and a vapor-phase species including elemental C in an internal space; and a heating furnace for accommodating the main container, generating a vapor pressure of the vapor-phase species including elemental Si in the internal space, and heating so that a temperature gradient is formed; the main container having an etching space formed by causing a portion of the main container disposed on the low-temperature side of the temperature gradient and the SiC substrate to face each other in a state in which the SiC substrate is disposed on the high-temperature side of the temperature gradient.

Abstract: An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.

Abstract: A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Abstract: A regularization unit standardizes similar expressions across a plurality of URIs in access logs of requests made to a plurality of web servers, thereby changing the URIs into regularized URIs. A calculation unit calculates, among the access logs that are from the same source, the relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for the same regularized URI and also corresponding to certain response codes. If the largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, a determination unit determines the regularized URIs to be scanning targets.

Abstract: A determination method includes determining an attack type of an attack code included in an attack request on the server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, and in a case of succeeding in an attack on the server as a result of the emulation, extracting a feature appearing in a response from the server, and examining whether a plurality of responses respectively corresponding to a plurality of requests to the server after the attack request each have the extracted feature, and in a case where at least any one of the plurality of responses has the extracted feature, determining that an attack by the attack code has succeeded, by a processor.

Abstract: A determination method includes determining an attack type of an attack code included in an attack request on a server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, extracting a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation, and determining that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature, by a processor.

Abstract: An estimation unit (136) retrieves a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from a query inserted into a Web request. In addition, the estimation unit (136) presents information for specifying the type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained by the retrieval of the retrieval unit. An estimation unit retrieves a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from a query inserted into a Web request. In addition, the estimation unit presents information for specifying the type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained by the retrieval of the retrieval unit.

Abstract: Provided is a surface processing apparatus and a surface processing method for a SiC substrate using anodization. The surface processing apparatus for the SiC substrate includes a surface processing pad and a power supply device. The surface processing pad includes a grinding wheel layer. The grinding wheel layer is disposed facing a workpiece surface of the SiC substrate. The power supply device passes a pulsed current having a period greater than 0.01 seconds and less than or equal to 20 seconds for anodizing the workpiece surface to be processed by the grinding wheel layer through the SiC substrate as an anode in the presence of an electrolyte.

Abstract: A surface processing method for a SiC substrate includes the following processes or steps: anodizing a workpiece surface of the SiC substrate by passing a current having a current density of 15 mA/cm2 or more through the SiC substrate as an anode in the presence of an electrolyte; disposing a grinding wheel layer of a surface processing pad to the workpiece surface and selectively removing, with the grinding wheel layer, an oxide formed on the workpiece surface through anodization; and performing, simultaneously or sequentially, the anodization of the workpiece surface and the selective removal of the oxide formed on the workpiece surface with the grinding wheel layer.

Abstract: A communication device is installed in between a client terminal and a web server which performs communication with the client terminal. The communication device includes a memory, and processing circuitry coupled to the memory and configured to of information included in communication between the web server and the client terminal, perform obfuscation with respect to information related to web application, and send communication, which includes information obfuscated at the performing, to destination.

Abstract: A device for manufacturing a SiC substrate, in which formation of macro-step bunching is suppressed, comprises: a main body container that is capable of accommodating a SiC substrate and generates, by heating, a vapor pressure of gaseous species containing Si elements and gaseous species containing C elements, in an internal space; and a heating furnace that accommodates the main body container and performs heating so that a vapor pressure of the gaseous species containing Si elements is generated and a temperature gradient is formed, wherein the main body container has an etching space S1 and a Si vapor supply source capable of supplying Si vapor into the main body container, the etching space S1 being formed by making the SiC substrate face a portion of the main body container arranged on a lower-temperature side of the temperature gradient while the SiC substrate is disposed on a higher-temperature side of the temperature gradient.

Abstract: A device for manufacturing a SiC substrate, in which the occurrence of a work-affected layer is reduced, or from which a work-affected layer is removed, comprises: a main container which can accommodate a SiC substrate and which generates, by heating, a vapor pressure of a vapor-phase species including elemental Si and a vapor-phase species including elemental C in an internal space; and a heating furnace for accommodating the main container, generating a vapor pressure of the vapor-phase species including elemental Si in the internal space, and heating so that a temperature gradient is formed; the main container having an etching space formed by causing a portion of the main container disposed on the low-temperature side of the temperature gradient and the SiC substrate to face each other in a state in which the SiC substrate is disposed on the high-temperature side of the temperature gradient.

Abstract: An apparatus for producing an SiC substrate, by which an SiC substrate having a thin base substrate layer is able to be produced, while suppressing deformation or breakage, includes a main container which is capable of containing an SiC base substrate, and which produces a vapor pressure of a vapor-phase species containing elemental Si and a vapor-phase species containing elemental C within the internal space by means of heating; and a heating furnace which contains the main container and heats the main container so as to form a temperature gradient, while producing a vapor pressure of a vapor-phase species containing elemental Si within the internal space. The main container has a growth space in which a growth layer is formed on one surface of the SiC base substrate, and an etching space in which the other surface of the SiC base substrate is etched.

Abstract: A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Abstract: An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.

Abstract: A regularization unit standardizes similar expressions across a plurality of URIs in access logs of requests made to a plurality of web servers, thereby changing the URIs into regularized URIs. A calculation unit calculates, among the access logs that are from the same source, the relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for the same regularized URI and also corresponding to certain response codes. If the largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, a determination unit determines the regularized URIs to be scanning targets.

Abstract: A determination method includes determining an attack type of an attack code included in an attack request on the server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, and in a case of succeeding in an attack on the server as a result of the emulation, extracting a feature appearing in a response from the server, and examining whether a plurality of responses respectively corresponding to a plurality of requests to the server after the attack request each have the extracted feature, and in a case where at least any one of the plurality of responses has the extracted feature, determining that an attack by the attack code has succeeded, by a processor.

Abstract: A determination method includes determining an attack type of an attack code included in an attack request on a server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, extracting a feature related to a backdoor operation appearing in an attack code on the server in a case of succeeding in an attack on the server as a result of the emulation, and determining that an attack by the attack code has succeeded in a case where a communication log of the server has the extracted feature, by a processor.

Abstract: A command server identification device adds a tag to data received by malware upon execution of the malware, the tag capable of uniquely identifying identification information for a transmission source of the data, and tracks propagation of the data added with the tag. The command server identification device acquires a tag of data referenced by a branch instruction executed by the malware, among the tracked data. The command server identification device analyzes information on an instruction of a branch destination not executed by the malware after the branch instruction. Then, the command server identification device identifies identification information of a command server for issuing a command to the malware from the identification information of the transmission source corresponding to the acquired tag, based on the result of analysis.

Abstract: A detecting apparatus generates a collection of events, the collection being formed based on a predetermined condition, from events obtained for each identifier identifying a terminal in a monitoring target network or a piece of malware. The detecting apparatus then extracts, from a cluster formed of collections of events, the collections having a similarity therebetween equal to or larger than a certain similarity, events commonly appearing in the collections of events belonging to the same cluster, and extracts, according to a predetermined condition, the taken out events as a collection of detection purpose events. The detecting apparatus then detects that a malware infected terminal is present in the monitoring target network, if a generated collection of events based on communications in the monitoring target network is determined to match the extracted collection of detection purpose events.