Abstract: An estimation device includes processing circuitry configured to extract a fixed-length feature amount from a payload of communication data, calculate a similarity between feature amounts of abnormal communication data, and determine that events are of a same type when the calculated similarity is greater than a predetermined threshold.

Abstract: A learning apparatus includes: a first estimation unit—configured to learn normal communication data, estimate probability density of the normal communication data, and update a parameter of a model; a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit; a second estimation unit configured to perform learning for each of clusters resulting from the clustering by the clustering unit, and estimate the probability density of the normal communication data of the cluster and update a parameter of a model representing characteristics of the probability density of the normal communication data of the cluster by using, as an initial value of the parameter, a parameter having already been learned in the first estimation unit; and an integration unit configured to integrate the estimated probability density of the clusters.

Abstract: A learning device includes processing circuitry configured to calculate a degree of deviation between a first output obtained by inputting first training data to a learned first model and a second output obtained by inputting second training data created by giving noise to the first training data to a second model, and a degree of deviation between an intermediate representation of the first model generated in a process of obtaining the first output and an intermediate representation of the second model generated in a process of obtaining the second output, and update a parameter of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced.

Abstract: A detection device includes processing circuitry configured to acquire data to be detected and normal reference data, calculate a Learned Perceptual Image Patch Similarity (LPIPS) distance between the acquired data and the reference data, and classify the acquired data into either a Clean Sample or an Adversarial Example by using the calculated LPIPS distance.

Abstract: An object of the present invention is to provide a band estimation device, a band estimation method, and a program capable of calculating a necessary band of a link of a communication system with high accuracy, and ensure the communication quality and improve the band utilization efficiency. In the present invention, a machine learning model is created by learning a set of an upper limit value (line information) of a communication band of each line and observed traffic data for a communication system in which a plurality of lines is accommodated in a link between communication devices, a probability density function of a traffic amount at each time is estimated on the basis of the generated machine learning model and the line information at each time, and an upper limit value of a confidence interval of the estimated probability density function is set as a necessary band.

Abstract: A detection device includes a feature value database configured to store a packet feature value, a label assigned to each packet feature value, and a threshold used for determination in advance. The detection device includes a memory and a processor coupled to the memory. The processor is configured to perform operations including: converting a target packet into a feature value using a first natural language processing model that has been trained using normal communication packets as learning data; assigning a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model and the data stored in the feature value database; and determining whether the target packet has an anomaly based on the assigned label.

Abstract: An analysis server acquires observation information including a transmission source IP address, a transmission source MAC address, a transmission destination IP address, and a transmission destination MAC address in communication from each of sensing devices. The analysis server estimates a topology of a network on the basis of the acquired observation information. On the basis of the estimated topology, an analysis server creates a monitoring list indicating communication that is a target for transmission of the observation information for each sensing device such that any one sensing device on a path of the communication transmits the observation information of the communication for each piece of communication in the network, and transmits the monitoring list to the sensing device. Thereafter, each sensing device transmits the observation information of the communication to the analysis server on the basis of the monitoring list.

Abstract: A learning device acquires learning data of a model predicting a label of input data including an adversarial example. The learning device performs learning of the model using a loss function that flattens a loss landscape with respect to a parameter by adding noise in which KL divergence of a loss value in the model becomes maximum to the parameter of the model and learning data including the adversarial example when the noise is added to the parameter of the model and when the noise is not added.

Abstract: An evaluation device receives input of latent variables of a variational autoencoder, clusters the input latent variables, and assigns, for each cluster, a label indicating the cluster to latent variables belonging to the cluster. After that, the evaluation device performs learning of a classifier so as to accurately classify the latent variables based on the assigned label, performs an adversarial attack resistance evaluation for the classifier after learning, and outputs a result of the resistance evaluation. Thus, the evaluation device can perform an adversarial attack resistance evaluation even for a variational autoencoder that uses unlabeled data as input data.

Abstract: An estimation device includes processing circuitry configured to generate a feature quantity by performing invertible transformation on a payload of a packet character by character with respect to each packet determined to be abnormal or normal by an abnormality detector, and give a determination result as to whether a packet is abnormal or normal to the generated feature quantity, learn a model that classifies whether the packet is abnormal or normal by machine learning using the feature quantity of the payload of the packet and the determination result as to whether the packet is abnormal or normal as teacher data, extract a number of dimensions of the feature quantity in which a contribution degree to classification is equal to or greater than a predetermined value in the learned model, and estimate a cause part of abnormality in the payload of the packet determined to be abnormal.

Abstract: An object of the present invention is to provide a band estimation device, a band estimation method, and a program capable of calculating a necessary band of a link of a communication system with high accuracy, and ensure the communication quality and improve the band utilization efficiency. In the present invention, a machine learning model is created by learning a set of an upper limit value (line information) of a communication band of each line and observed traffic data for a communication system in which a plurality of lines is accommodated in a link between communication devices, a probability density function of a traffic amount at each time is estimated on the basis of the generated machine learning model and the line information at each time, and an upper limit value of a confidence interval of the estimated probability density function is set as a necessary band.

Abstract: An acquisition unit acquires data for which a label is to be predicted. A learning unit learns a model representing a probability distribution of a label of the acquired data by using, as a filter, a correct answer label of the data so as to correctly predict a label for an adversarial example in which noise is added to the data.

Abstract: A SiC single crystal, including: a seed crystal; a first growth portion formed in a direction that is substantially orthogonal to a <0001> direction; a second growth portion formed in a direction that is substantially orthogonal to the <0001> direction and substantially orthogonal to the direction in which the first growth portion is formed; a third growth portion that is formed on a surface of the seed crystal opposite the first growth portion; and a fourth growth portion that is formed on a surface of the seed crystal opposite the second growth portion.

Abstract: An inference device executes a first conversion step of converting an output from an intermediate layer using a bounded nonlinear function in a final layer of a deep neural network having the intermediate layer and the final layer. Moreover, the inference device executes a second conversion step of converting a value obtained by conversion in the first conversion step using an activation function.

Abstract: A learning device includes processing circuitry configured to acquire data with a label to be predicted, and learn a model that represents probability distribution of the label of the acquired data using an eigenvector corresponding to a maximum eigenvalue in a Fisher information matrix for the data in the model.

Abstract: A detection device includes acquisition circuitry, conversion circuitry, and detection circuitry. The acquisition circuitry acquires data to be classified using a model. The conversion circuitry converts the data acquired using noise in a predetermined direction. The detection circuitry detects an adversarial example using a change in output between the data acquired and the data converted, at a time when the data acquired and the data converted are input to the model.

Abstract: A detecting device obtains a network log and a host log of a device. The detecting device converts the network log into a network feature value in a form which is inputtable to a multimodal generative model which generates output data on the basis of multiple latent variables represented by random variables. The detecting device converts the host log into a host feature value in a form which is inputtable to the generative model. The detecting device also inputs at least one of the network feature value and the host feature value to the generative model and calculates output data. The detecting device detects an abnormality about the device using an anomaly score calculated on the basis of the output data.

Abstract: An acquisition unit 15a acquires data in a task. The learning unit 15b learns a generation model representing a distribution of a probability of the data in the task so that a mutual information amount between a latent variable and an observed variable is minimized in the model.

Abstract: A learning apparatus includes: a first estimation unit—configured to learn normal communication data, estimate probability density of the normal communication data, and update a parameter of a model; a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit; a second estimation unit configured to perform learning for each of clusters resulting from the clustering by the clustering unit, and estimate the probability density of the normal communication data of the cluster and update a parameter of a model representing characteristics of the probability density of the normal communication data of the cluster by using, as an initial value of the parameter, a parameter having already been learned in the first estimation unit; and an integration unit configured to integrate the estimated probability density of the clusters.

Abstract: An information processing apparatus includes processing circuitry configured to calculate, with respect to datasets into which data is divided based on individual labels serving as candidates for an index when the data is divided, an amount of information for each of division methods that use respective labels, divide the data into a plurality of datasets based on the division method that provides highest amount of information, of amounts of information calculated, and create, with use of the datasets divided, a learned model for each of the datasets.