Abstract: A detection device generates an event sequence from events that are acquired for each of identifiers that distinguish among terminals in a monitoring target network or pieces of malware, by taking into account an order of occurrence of the events. The detection device retrieves events that commonly occur in event sequences belonging to a same cluster among clusters including event sequences with similarities at a predetermined level or higher, and extracts, as a detection event sequence, a representative event sequence based on a relationship between events that have high occurrence rates in similar common event sequences. The detection device detects a malware infected terminal in the monitoring target network based on whether the event sequence generated based on a communication in the monitoring target network and the extracted detection event sequence match each other.

Abstract: A malicious communication pattern extraction device includes: a statistical value calculation unit that calculates a statistical value for an appearance frequency of each of plural communication patterns, from a traffic log obtained from traffic caused by malware, and a traffic log obtained from traffic in a predetermined communication environment; a malicious list candidate extraction unit that compares between the appearance frequency of the traffic logs for each of the communication patterns, based on the calculated statistical value, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold; and a threshold setting unit that sets a threshold so that an erroneous detection rate probability of erroneously detecting the traffic caused by malware and a detection rate probability of detecting the traffic caused by malware is equal to or more than a certain value.

Abstract: A detecting apparatus generates a collection of events, the collection being formed based on a predetermined condition, from events obtained for each identifier identifying a terminal in a monitoring target network or a piece of malware. The detecting apparatus then extracts, from a cluster formed of collections of events, the collections having a similarity therebetween equal to or larger than a certain similarity, events commonly appearing in the collections of events belonging to the same cluster, and extracts, according to a predetermined condition, the taken out events as a collection of detection purpose events. The detecting apparatus then detects that a malware infected terminal is present in the monitoring target network, if a generated collection of events based on communications in the monitoring target network is determined to match the extracted collection of detection purpose events.

Abstract: A malicious communication pattern extraction apparatus extracts communication patterns of traffic group of malwares, and replaces the values of predetermined field with variation in a traffic group with a wild card. Further, the malicious communication pattern extraction apparatus classifies pieces of malware having similar communication patterns in the traffic group into the same cluster, and for each cluster, extracts, as a malicious communication pattern, a communication pattern group having an appearance rate in a traffic group of respective pieces of malware in the cluster, the appearance rate being equal to or larger than a predetermined value. Thereafter, the malicious communication pattern extraction apparatus eliminates, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value.

Abstract: An assembly jig includes an upper jig frame that is provided above a longitudinal outer edge of a large structure, a lower jig frame that is provided below a longitudinal outer edge of the large structure, a connecting jig frame that connects the upper jig frame and the lower jig frame to each other, three supporting parts for supporting the lower jig frame from below, and a jig leg portion that is provided perpendicular to the direction in which the lower jig frame extends and parallel to a ground surface. The supporting parts are provided at three portions that are respectively located under two end portions of the jig leg portion and under the lower jig frame, and arrangement positions of the supporting parts provided at the three portions form a substantially triangular shape when seen from above.

Abstract: A malicious URL candidate extraction device extracts, from an access log including URLs accessed from a managed network, a known malicious URL excluded access log obtained by excluding an access log to known malicious URLs. The malicious URL candidate extraction device creates a minor URL list obtained by preferentially extracting, from URLs indicated in the known malicious URL excluded access log, URLs having a small number of times of access from the managed network. The malicious URL candidate extraction device also creates a popular URL excluded list obtained by preferentially excluding URLs having a large number of times of access from the managed network during a predetermined period of time. The malicious URL candidate extraction device outputs these lists as a malicious URL candidate list.

Abstract: There is provided an analysis rule adjustment device that adjusts an analysis rule used in a communication log analysis performed to detect malicious communication through a network. The analysis rule adjustment device includes a log acquisition unit, a log analysis unit, and a first analysis unit. The log acquisition unit acquires a communication log through a network to be defended and a communication log generated by malware. The log analysis unit analyzes the communication log acquired by the log acquisition unit on the basis of predetermined analysis rule and tuning condition. The first analysis unit analyzes an analysis result by the log analysis unit and calculates a recommended tuning value used in an adjustment of the predetermined analysis rule and satisfying the tuning condition.

Abstract: A URL selection method disclosed in the present application includes a first extraction step and a second extraction step. The first extraction step extracts URLs up to an upper limit value of the number of URLs set to each of URL groups in a range where a total number of URLs is within a predetermined number of URLs, in order of priority set to each of the URL groups, from each of the URL groups identified by analyzing a traffic log by techniques in different categories. The second extraction step further extracts URLs within the predetermined number of URLs, based on the priority, when the total number of URLs extracted from each of the URL groups in the first extraction step is less than the predetermined number of URLs.

Abstract: An extraction criterion determination method performed by an extraction criterion determination apparatus includes collecting a log information entry that is in a predetermined period of time and determined to be a specific communication, extracting a communication satisfying a criterion used to extract the specific communication from log information entries from the collected log information entries with reference to a storage unit storing an extraction criterion in which the criterion is defined, determining to adopt the extraction criterion when the ratio of the specific communications to the extracted communications is larger than or equal to a threshold, and performing a control to output the adopted extraction criterion.

Abstract: A traffic feature information extraction method including a regular expression process, a clustering process, and a feature information extraction process. The regular expression process extracts an item set in advance from a traffic log and represents a partial character string included in the item in a regular expression based on a predetermined rule. The clustering process clusters an entry of the traffic log represented in the regular expression. The feature information extraction process extracts, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the clustered traffic logs.

Abstract: An assembly jig includes an upper jig frame that is provided above a longitudinal outer edge of a large structure, a lower jig frame that is provided below a longitudinal outer edge of the large structure, a connecting jig frame that connects the upper jig frame and the lower jig frame to each other, three supporting parts for supporting the lower jig frame from below, and a jig leg portion that is provided perpendicular to the direction in which the lower jig frame extends and parallel to a ground surface. The supporting parts are provided at three portions that are respectively located under two end portions of the jig leg portion and under the lower jig frame, and arrangement positions of the supporting parts provided at the three portions form a substantially triangular shape when seen from above.

Abstract: An air bag door ensures smoother inflation of an air bag. The air bag door has a groove portion of a predetermined depth serving as a predetermined break portion and provided at the peripheral edge of a door panel provided at a base of an instrument panel. The first groove portion extending at the boundary between the base and the door panel has side wall surfaces defining the base side of the first groove portion. The side wall surfaces are obliquely formed in such a way as to come away outward from the door panel as the groove portion extends toward a bottom portion from an open end opening at the back side of the base. The predetermined break portion provided at the bottom portion of the first groove portion is positioned outward of a base-side corner portion of the open end.