Abstract: The present invention provides an information processing system for more appropriately classifying elements that constitute an information processing device or the like. This information processing system is provided with: a means that, on the basis of information indicating the relationship between a plurality of elements that constitute a system, acquires, for first elements to be classified, a set of second elements capable of arriving at the first elements via a relationship of arbitrary numbers; and a means that, on the basis of the set corresponding to the first elements, classifies each of the first elements in any of a plurality of roles.

Abstract: An information processing apparatus (2000) compares a name of a determination target file with a name of one or more normal files. The information processing apparatus (2000) outputs information related to the determination target file, when a name of the determination target file does not coincide with a name of any of the normal files, and a degree of reliability of the determination target file is equal to or less than a threshold value. A degree of reliability of the determination target file is calculated, based on a degree of similarity between a name of the determination target file and a name of each of the normal files.

Abstract: An information processing apparatus (2000) acquires an event graph (10) to be output. In the event graph (10), an activity content in an event related to an activity of a program is represented as an edge, and each of a subject and an object of the event is represented as a node. By using score information, the information processing apparatus (2000) determines a subgraph that matches an event graph (10) having a score equal to or higher than a threshold value from the event graphs (10) to be output. The score information associates each of a plurality of event graphs (10) with a score based on the number of occurrences of an event sequence represented by the event graph (10). The information processing apparatus (2000) outputs the event graph (10) to be output in a mode in which the determined subgraph and the other portion can be discriminated from each other.

Abstract: An information processing apparatus (2000) extracts, from a communication history (20) representing a history of network communication performed by each of a plurality of mobile terminals (10), a communication history (20) indicating communication related to a similar attack. Herein, the communication history (20) includes positional information about the mobile terminal (10). The information processing apparatus (2000) generates attack information related to an attack on the mobile terminal (10) by using positional information indicated by each of the extracted communication histories (20), and outputs the generated attack information.

Abstract: An information processing apparatus (2000) acquires an event graph (10) to be output and determines a subgraph satisfying a predetermined reference from the acquired event graph (10) to be output. In the event graph (10), an activity content in an event related to an activity of a program is represented as an edge (14), and each of a subject and an object of the event is represented as a node (12). The information processing apparatus (2000) outputs the event graph (10) with an output mode of the determined subgraph as a first mode and with an output mode of another portion as a mode other than the first mode. The first mode is a mode in which at least one of the number of nodes (12) and the number of edges (14) is reduced than the number included in the determined graph.

Abstract: A history output apparatus (2000) acquires an abnormal event history (10) being information representing an abnormal event occurring in a target system (100), and determines a kind of the abnormal event represented by the abnormal event history (10). When a kind of the determined abnormal event is a first kind, the history output apparatus (2000) determines a terminal (110) in which the abnormal event occurs, as an output target terminal. Further, the history output apparatus (2000) also determines another terminal (110) performing communication with the terminal (110) in which the abnormal event occurs at or before a point when the abnormal event occurs, as an output target terminal. When the abnormal event represented by the acquired abnormal event history (10) is an abnormal event occurring in the output target terminal, the history output apparatus (2000) outputs information relating to the abnormal event.

Abstract: A first information processing apparatus (2000) determines an alternative representation (20) of an event sequence represented by a plurality of event histories (12), by use of dictionary data (30). The first information processing apparatus (2000) outputs information including the determined alternative representation (20). The dictionary data (30) indicate an event sequence and an alternative representation (20) relating to the event sequence in association with each other.

Abstract: To enable a user to easily recognize temporal order of elements included in a retrieval sentence, a retrieval sentence utilization device 10 includes: a retrieval sentence division unit 11 for dividing a retrieval sentence into a plurality of retrieval contents each of which includes an event; and a directed graph generation unit 12 for generating, from each of the retrieval contents, a subtree in which the event is an edge and a source of the event and an object of the event are nodes, and integrating a plurality of subtrees generated from the retrieval contents to generate a directed graph, wherein the directed graph generation unit 12 places the plurality of subtrees in the directed graph according to occurrence order of events corresponding to the plurality of subtrees.

Abstract: Provided is an information processing device which is capable of suppressing a deterioration in accuracy of detecting an anomaly and accuracy of analyzing the anomaly, while suppressing an increase in an amount of data to be stored. The information processing system includes anomaly detection unit that collects event data indicating a predetermined event detected in a process of a device to be monitored, determines whether a predetermined index value related to the event exceeds a preset first threshold, and instructs enhanced monitoring of the device to be monitored and the process related to the event when the index value exceeds the first threshold, and collection instruction unit that determines an additional event being an event to be additionally monitored when the enhanced monitoring is instructed, and instructs the device to be monitored, which is subjected to the enhanced monitoring, to monitor the determined additional event.

Abstract: An anomaly assessment device includes: a storage storing a correspondence relation between a type of a device, and a transition state candidate group in a stable state of the device of the type; at least one memory storing instructions; and at least one processor configured to execute the instructions to: acquire event information of a monitoring target device; identify a transition state associated with the event information acquired of the monitoring target device; and assesse normality/anomaly of the monitoring target device, based on the transition state candidate group associated with a type of the monitoring target device in the stored correspondence relation, and the identified transition state.

Abstract: Provided is, for example, a display control apparatus that generates display information with which an event having occurred in an information processing system can be easily determined. This display control apparatus 101 comprises a display control unit 102 that, on the basis of device information indicating a device detected by a first information processing apparatus in an information processing system and communication information indicating communication executed between a second information processing apparatus in the information processing system and a third information processing apparatus in the information processing system: performs displaying on a display apparatus in a manner such that said device and said first information processing apparatus are associated with one another; and performs displaying on said display apparatus in a manner such that said second information processing apparatus and said third information processing apparatus are associated with one another.

Abstract: Based on a normal model, it is detected whether or not an event signal of a computer system is anomalous. In parallel with the normal-model-based anomaly detection, it is detected based on a rule whether or not the event signal is anomalous. Then, a final anomaly detection result is generated by performing comprehensive determination based on detection results of the normal-model-based anomaly detection and the rule-based anomaly detection.

Abstract: An information processing apparatus (2000) classifies each event that occurred in a target apparatus to be determined (10) either as an event (event of a first class) that also occurs in a standard apparatus (20) or as an event (event of a second class) that does not occur in the standard apparatus (20). Herein, a first model used for a determination with respect to an event that also occurs in the standard apparatus (20) and a second model used for a determination with respect to an event that does not occur in the standard apparatus (20) are used as models for determining whether an event that occurs in a target apparatus to be determined (10) is a target for warning. The information processing apparatus (2000) performs learning of the first model using an event of the first class. Further, the information processing apparatus (2000) performs learning of the second model using an event of the second class.

Abstract: An information processing apparatus generates a graph that represents an action of a program. On the graph, an edge represents action contents of a process in an event. Further, two nodes connected by the edge respectively represent a subject and an object of the event. The information processing apparatus outputs the generated graph. Further, the information processing apparatus also alters the generated graph. When an index value of an event satisfies a first predetermined condition which index value is based on the number of occurrences or the frequency of occurrences of the event, the information processing apparatus alters the graph with respect to an edge representing the event.

Abstract: Provided is an information processing device which is capable of suppressing a deterioration in accuracy of detecting an anomaly and accuracy of analyzing the anomaly, while suppressing an increase in an amount of data to be stored. The information processing system includes anomaly detection unit that collects event data indicating a predetermined event detected in a process of a device to be monitored, determines whether a predetermined index value related to the event exceeds a preset first threshold, and instructs enhanced monitoring of the device to be monitored and the process related to the event when the index value exceeds the first threshold, and collection instruction unit that determines an additional event being an event to be additionally monitored when the enhanced monitoring is instructed, and instructs the device to be monitored, which is subjected to the enhanced monitoring, to monitor the determined additional event.

Abstract: An information processing apparatus includes: a reach-extent extraction unit configured to extract, with use of a relationship graph representing relationships between a plurality of elements included in a system and location information that indicates, on the relationship graph, a plurality of locations in the system where anomalies have been detected, paths in the relationship graph as being reach extents, the path including a set of the elements that are directly or indirectly related to each of the plurality of locations as a source; and a shared-extent extraction unit configured to extract an influence process of an anomaly by extracting an extent that is shared in at least a prescribed number of paths among paths in the relationship graph that have been extracted as the reach extents.

Abstract: The present invention provides an information processing device that outputs information including the data transmission relationship between elements constituting an information processing system, the information indicating the state of the information processing system. The information processing device includes a graphing means for generating a relationship graph based on an event log indicating the behavior of each of a plurality of processes operating in the system, the relationship graph having the processes as the vertices thereof and having the data transmission relationship between the vertices as the sides thereof; and a graph output means for outputting the generated relationship graph.

Abstract: The present invention provides an information processing device that improves the detectability of system errors. This information processing device includes: a means that generates a state graph based on relationship change information indicating a change in the relationship between a plurality of elements included in a system, the state graph having the elements as the vertices thereof and the relationship between the elements as the sides thereof; a means that generates a normal model having the state graph as a set of conditions to be fulfilled during normal system operation, based on the relationship change information; and a means that detects system errors and outputs error information indicating detected errors, based on the state graph and the normal model.

Abstract: The purpose of the present invention is to provide a technology which assists a verifying party in ascertaining an anomaly in an event of which notification has been made. Provided is an assistance device, comprising: an acquisition unit which acquires as an associated event, from among events which take place among a plurality of elements, and with respect to elements which have been associated with an event which has been detected as an anomalous event, an event other than the anomalous event which has been associated with the elements; and a generating unit which, on the basis of the anomalous event and the associated event, generates a relational graph in which the elements are vertices, the relations among the elements are edges, the anomalous event and the associated event are respectively represented, and the associated event is displayed in a display screen in a different manner from the manner in which the anomalous event is displayed.

Abstract: The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.