Abstract: There is provided an analysis rule adjustment device that adjusts an analysis rule used in a communication log analysis performed to detect malicious communication through a network. The analysis rule adjustment device includes a log acquisition unit, a log analysis unit, and a first analysis unit. The log acquisition unit acquires a communication log through a network to be defended and a communication log generated by malware. The log analysis unit analyzes the communication log acquired by the log acquisition unit on the basis of predetermined analysis rule and tuning condition. The first analysis unit analyzes an analysis result by the log analysis unit and calculates a recommended tuning value used in an adjustment of the predetermined analysis rule and satisfying the tuning condition.

Abstract: A blacklist generating device acquires a malicious communication log and a normal communication log. A malicious communication profile extracting function calculates statistics on communication patterns included in the malicious communication log and outputs a communication pattern satisfying a certain condition to a potential blacklist. A normal communication profile extracting function calculates statistics on communication patterns included in the normal communication log and outputs a communication pattern satisfying a certain condition to a whitelist. A blacklist creating function searches the potential blacklist for a value with the value on the whitelist, excludes a coincident communication pattern from the potential blacklist, and creates a blacklist.

Abstract: A malicious communication pattern extraction device includes: a statistical value calculation unit that calculates a statistical value for an appearance frequency of each of plural communication patterns, from a traffic log obtained from traffic caused by malware, and a traffic log obtained from traffic in a predetermined communication environment; a malicious list candidate extraction unit that compares between the appearance frequency of the traffic logs for each of the communication patterns, based on the calculated statistical value, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold; and a threshold setting unit that sets a threshold so that an erroneous detection rate probability of erroneously detecting the traffic caused by malware and a detection rate probability of detecting the traffic caused by malware is equal to or more than a certain value.

Abstract: A network monitoring apparatus includes a log collecting unit and a log analyzing unit. The log collecting unit collects log information related to passing packets from at least one of a FW and a proxy server, which are included in a network, for packets transferred in the network. The log analyzing unit extracts log information satisfying a predetermined condition in a predetermined time period by analyzing, over time, the log information collected by the log collecting unit.

Abstract: A malicious URL candidate extraction device extracts, from an access log including URLs accessed from a managed network, a known malicious URL excluded access log obtained by excluding an access log to known malicious URLs. The malicious URL candidate extraction device creates a minor URL list obtained by preferentially extracting, from URLs indicated in the known malicious URL excluded access log, URLs having a small number of times of access from the managed network. The malicious URL candidate extraction device also creates a popular URL excluded list obtained by preferentially excluding URLs having a large number of times of access from the managed network during a predetermined period of time. The malicious URL candidate extraction device outputs these lists as a malicious URL candidate list.

Abstract: There is provided an analysis rule adjustment device that adjusts an analysis rule used in a communication log analysis performed to detect malicious communication through a network. The analysis rule adjustment device includes a log acquisition unit, a log analysis unit, and a first analysis unit. The log acquisition unit acquires a communication log through a network to be defended and a communication log generated by malware. The log analysis unit analyzes the communication log acquired by the log acquisition unit on the basis of predetermined analysis rule and tuning condition. The first analysis unit analyzes an analysis result by the log analysis unit and calculates a recommended tuning value used in an adjustment of the predetermined analysis rule and satisfying the tuning condition.

Abstract: A URL selection method disclosed in the present application includes a first extraction step and a second extraction step. The first extraction step extracts URLs up to an upper limit value of the number of URLs set to each of URL groups in a range where a total number of URLs is within a predetermined number of URLs, in order of priority set to each of the URL groups, from each of the URL groups identified by analyzing a traffic log by techniques in different categories. The second extraction step further extracts URLs within the predetermined number of URLs, based on the priority, when the total number of URLs extracted from each of the URL groups in the first extraction step is less than the predetermined number of URLs.

Abstract: An extraction criterion determination method performed by an extraction criterion determination apparatus includes collecting a log information entry that is in a predetermined period of time and determined to be a specific communication, extracting a communication satisfying a criterion used to extract the specific communication from log information entries from the collected log information entries with reference to a storage unit storing an extraction criterion in which the criterion is defined, determining to adopt the extraction criterion when the ratio of the specific communications to the extracted communications is larger than or equal to a threshold, and performing a control to output the adopted extraction criterion.

Abstract: A traffic feature information extraction method including a regular expression process, a clustering process, and a feature information extraction process. The regular expression process extracts an item set in advance from a traffic log and represents a partial character string included in the item in a regular expression based on a predetermined rule. The clustering process clusters an entry of the traffic log represented in the regular expression. The feature information extraction process extracts, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the clustered traffic logs.

Abstract: A network monitoring apparatus includes a log collecting unit and a log analyzing unit. The log collecting unit collects log information related to passing packets from at least one of a FW and a proxy server, which are included in a network, for packets transferred in the network. The log analyzing unit extracts log information satisfying a predetermined condition in a predetermined time period by analyzing, over time, the log information collected by the log collecting unit.

Abstract: A sintered gear comprises: plural tooth portion having a tooth flank and a tooth bottom land; a high density area formed over entire surface of the tooth portion, the high density area having a density of 7.6 Mg/m3 or more and formed with a depth of 1 mm or more from the surface; a low density area formed in deeper area than the high density area, the low density area having a density of 7.3 Mg/m3 or less; and an intermediate area formed between the high density area and the low density area, the intermediate area having a density gradient in which the density is gradually decreased from the high density area to the low density area.

Abstract: A sintered gear comprises: plural tooth portion having a tooth flank and a tooth bottom land; a high density area formed over entire surface of the tooth portion, the high density area having a density of 7.6 Mg/m3 or more and formed with a depth of 1 mm or more from the surface; a low density area formed in deeper area than the high density area, the low density area having a density of 7.3 Mg/m3 or less; and an intermediate area formed between the high density area and the low density area, the intermediate area having a density gradient in which the density is gradually decreased from the high density area to the low density area.

Abstract: A wafer manufacturing process for a semiconductor integrated circuit device, including testing the semiconductor wafer at a unit of chip each time a predetermined treating step is performed. The test results are feed to a computer control for restricting succeeding treatments or further testing of chip or chips based on the test results and the predetermined number of chips to be produced. Semiconductor wafer(s) is/are loaded for manufacture on the basis of the number of chips to be produced, taking into account of any losses created by defective chips detected during each testing step and any excess created by additional semiconductor wafers loaded in response to shortages created by defects. The excess chips are monitored by the computer control and any succeeding treatments or further testing of the excess chips are halted to save time and manufacturing costs.

Abstract: A method for forming an insulating film on an interconnection layer for an integrated circuit, or the like, includes the steps of forming an aluminum layer on the surface of a substrate, oxidizing a thin portion of the upper surface of the aluminum layer in order to convert the thin parts into a porous alumina film, applying a photoresist film having a predetermined pattern on the upper surface of the porous alumina film, and etching those portions of the porous alumina film, together with the aluminum layer which are not covered with the photoresist film. Then, the photoresist film is removed and an aluminum film is formed on the entire surface of the resulting substrate; the aluminum film is oxidized, to form a porous alumina film, and the surface of the remaining aluminum layer is anodized, in order to form a non-porous alumina film. Finally, unnecessary portions of the remaining porous alumina film are removed, and a film is formed by chemical vapor deposition on the resulting structure.