Abstract: A computer system comprises an analysis module configured to execute dynamic analysis for a sample of a malicious program, and to output an analysis result including a coupling destination to and from which the malicious program communicates; a variation detection module configured to detect variation of the coupling destination based on results of cyclic observation of the coupling destination, and to output a result of the detection; and an information sharing module configured to store information output from the analysis module and information output from the variation detection module in a form that allows sharing among a plurality of external computers.

Abstract: A technique for collecting information concerning those files distributed on a file sharing network and for detecting an information leak file to take corrective measures is provided. Supervised information is generated by adding as attributes a file type, a speech-part appearance frequency of words making up a file name and a result of human-made judgment as to whether a file being inspected is the information leak file to key information collected from the file sharing network. Next, the supervised information is input to a decision tree leaning algorithm, thereby causing it to learn an information leak file judgment rule and then derive a decision tree for use in information leak file judgment. Thereafter, this decision tree is used to detect the information leak file from key information flowing on the file sharing network, followed by alert transmission and key information invalidation, thereby preventing damage expansion.

Abstract: An analysis unit which effectively detects incidents on the basis of events detected by a security unit such as an intrusion detection system (IDS) or a firewall (FW) installed in a network stores statistical information that is frequency-distributed information of event information obtained from the collection unit, frequency component information obtained by frequency-analyzing the statistical information and the result obtained by making analysis on the basis of the frequency component. The collection unit collects and normalizes event log information outputted by IDS or FW to be stored in an event database (DB). An alert notification unit includes an alert database (DB) for storing an alert instruction transmitted from the analysis unit and an alert notification destination and reports occurrence of incidents to a manager or the like in accordance with the instruction.

Abstract: An attack node set determination apparatus obtains an event log basic parameter extracted from collected event logs and attribute information based on the event log basic parameter. The attack node set determination apparatus performs a clustering on a space having dimensions of part or all of the obtained attribute information and event log basic parameter, computes a cluster, and transmits information on the cluster and a countermeasure against the cluster to a firewall. Upon detecting an attack packet from an attack node set, the firewall identifies a cluster including the attack packet and conducts a countermeasure against the whole identified cluster.

Abstract: A network management system which includes a plurality of network devices operating in a coordinated manner and a management server managing the network devices. The management server includes apparatus for defining policy information and for generating setup information using policy information to generate setup information for each network device. The system generates setup information for each network device, distributes setup information to each network device, installs setup information to each network device, enables settings, collects setup information for each network device, and organizes and checks for consistency in the collected information.

Abstract: An analysis unit which effectively detects incidents on the basis of events detected by a security unit such as an intrusion detection system (IDS) or a firewall (FW) installed in a network stores statistical information that is frequency-distributed information of event information obtained from the collection unit, frequency component information obtained by frequency-analyzing the statistical information and the result obtained by making analysis on the basis of the frequency component. The collection unit collects and normalizes event log information outputted by IDS or FW to be stored in an event database (DB). An alert notification unit includes an alert database (DB) for storing an alert instruction transmitted from the analysis unit and an alert notification destination and reports occurrence of incidents to a manager or the like in accordance with the instruction.

Abstract: In view of providing a network system enabling communication having passed fire walls (repeaters) and assuring high security and operation flexibility through access control based on users and applications, a user-held table indicating correspondence between repeaters and passwords, a repeater-held table indicating correspondence between users and passwords and a table indicating access regions are defined respectively for users, departments of users and official positions of users and a route control information storing table indicating correspondence between networks and next transmitting destination is also provided to execute the access control for each user.

Abstract: A phase change optical disk having a reflectance relation of Rc<Ra and is adapted such that high recording characteristic can be obtained starting at a first recording time even when a recording operation is carried out without conducting an initialization process. For this purpose, a multiple reflection layer (2), a first dielectric layer (3), a recording layer (4), a second dielectric layer (5), a reflecting layer (6) and an UV curable resin layer (7) are provided on a substrate (1). The recording layer (4) is deposited at a temperature of the substrate during the deposition of the recording layer set to a temperature which makes the recording layer into a stable amorphous conditions and which is lower than a crystallizing temperature of the recording layer. Thus, the recording layer (4) is deposited into a stable amorphous state.

Abstract: In a network system in which each of multiple networks, each containing computers and relay computers, is connected to another network via multiple relay computers which belong to the network concerned, and the communication between two computers belonging to different networks is performed on a communication path via multiple relay computers, there is provided a management computer for collectively managing logs which are dispersively and separately recorded in the multiple respective relay computers.

Abstract: A security management and audit of a business information system in accordance with an information security policy is simplified. Provided is a security management and audit program database 133 in which the information security policy and an object system correspond to management and audit programs. The management and audit program corresponding to a range of the information security policy and the object system, which are designated by an operator, is retrieved and automatically executed. The management and audit program performs a management and audit concerning an information security policy of an object system corresponding to itself.

Abstract: A security management and audit of a business information system in accordance with an information security policy is simplified. Provided is a security management and audit program database 133 in which the information security policy and an object system correspond to management and audit programs. The management and audit program corresponding to a range of the information security policy and the object system, which are designated by an operator, is retrieved and automatically executed. The management and audit program performs a management and audit concerning an information security policy of an object system corresponding to itself.

Abstract: An optical information recording medium comprising a thin plastic substrate of 0.6 mm or thinner, wherein the substrate is protected against strain without being limited by a film structure and a film formation condition. A single-layer or multilayer thin film (70) is formed on a plastic disk-like substrate having a center hole (10). This thin film (70) has a strain relief area (72) inside a recording area (71). This strain relief area (72) is formed by setting an outer diameter of an undeposited inner portion (5) to a value satisfying the following formula (1), for example: A0≦AX≦−0.172P+0.163 where A0: diameter of center hole, AX: outer diameter of undeposited inner portion, P: total strain occurring in thin film when film depositing.

Abstract: A method of conducting a connectionless communication in a network communication system including a client, a server, and a plurality of proxy servers which are disposed on a transmission path between the client and server. The communication is accomplished by use of specification of a communication address thereof and a port number dynamically assigned by the computer. (a) The server transmits own communication address and own port number to the client. (b) The client transmits own communication address and own port number as well as the communication address and port number of the server to a first adjacent proxy server computer. (c) The N-th (N≧1) proxy server transmits own communication address and own server side port number as well as the communication address and the port number of the server to an (N+1)-st proxy server. (d) step (e) is repeatedly executed by incrementally increasing N until the (N+1)-th proxy server becomes a terminal proxy server.

Abstract: In view of providing a network system enabling communication having passed fire walls (repeaters) and assuring high security and operation flexibility through access control based on users and applications, a user-held table indicating correspondence between repeaters and passwords, a repeater-held table indicating correspondence between users and passwords and a table indicating access regions are defined respectively for users, departments of users and official positions of users and a route control information storing table indicating correspondence between networks and next transmitting destination is also provided to execute the access control for each user.

Abstract: In a network system in which each of multiple networks, each containing computers and relay computers, is connected to another network via multiple relay computers which belong to the network concerned, and the communication between two computers belonging to different networks is performed on a communication path via multiple relay computers, there is provided a management computer for collectively managing logs which are dispersively and separately recorded in the multiple respective relay computers.

Abstract: A network system includes: a plurality of repeating installations connected to the network; a plurality of computers connected to the network, each of the computers being connected to the network through a corresponding repeating installation; and a management unit connected to the network. The management unit includes distribution means for distributing at least one of an external audit program and an internal audit program for defining the processing procedure, by which the repeating installation audits vulnerability of at least one of the plurality of computers, from the management unit to the repeating installations through the network.

Abstract: A security system for a network connected with a plurality of computers is disclosed, in which one of the computers monitors the internal status thereof. An internal status monitor unit of the one computer detects the occurrence of a fault and the type of the fault in the one computer. An access control unit of the one computer controls the access to the resources of the one computer. An information transmission unit of the one computer transmits a message to other computers of the network indicating the occurrence of a fault and the type of the fault in the one computer through the network in the case where the internal status monitor unit detects the occurrence of the fault in the one computer. The access control unit executes the processing for protecting the resources of the one computer in accordance with the type of the fault of the one computer in the case where the internal status monitor unit detects the fault of the one computer.

Abstract: A phase-change type optical recording medium, wherein (1) recording, erasing and reading of information by irradiating light is possible, and the medium has a structure in which a first protective layer, a recording layer, a second protective layer, and a reflective layer are consecutively deposited in this order on a transparent substrate, (2) the thickness of the first protective layer is in the range of the thickness, where reflectivity of light on irradiating the layer from the side of the transparent substrate exhibits a minimum, .+-.30 nm, and (3) the second protective layer has the absorption coefficient k satisfying the equation as follows0.05.ltoreq.k.ltoreq.2.5.According to the present invention, unevenness of shapes and sizes of the recording pits can be reduced, irrespective of whether the state of the recording layer is crystalline or amorphous.

Abstract: The voice mail system includes a voice mail exchanger and a mail server. A voice mail communication between a telephone and a terminal device, such as a client computer, is registered in a LAN based multi-media mail box. A PBX based voice mail apparatus and a LAN based multi-media mail system are integrated such that voice information can be commonly used and reused.