Abstract: Provided is an analysis apparatus including a first storage device configured to store data, and a processing circuitry that is configured to control the own apparatus to function as: a dispatcher that is communicably connected to an analysis target device that performs operational processing by use of a processor and a memory unit, and generates collection target data for reproducing at least part of a state of the operational processing in the analysis target device, in accordance with data being transmitted and received between the processor and the memory unit; a data mapper that assigns, to one or more areas included in the collection target data, tag information for identifying the area; and a data writer that saves the one or more areas into the first storage device in accordance with a first policy defining a procedure of saving the collection target data into the first storage device.

Abstract: Provided is a log information generation apparatus and the like that generates log information where log of communication via a communication network are arranged in communication occurrence order. A log information generation apparatus provides time information including a second time in an information processing apparatus to a difference calculation apparatus in accordance with communication start information transmitted to a plurality of information processing apparatuses communicably connecting to a communication network at a start of communication processing via the communication network, the difference calculation apparatus calculating a difference between a input first time and a reference time; and generates log information associating arranged time with a content of communication processing, the arranged time obtained by arranging a time of the communication processing based on the difference calculated for the second time by the difference calculation apparatus.

Abstract: An information collection system for efficiently collecting target information from an enormous amount of contents in a variety of formats is provided. The information collection system 100 includes a learning unit 110 and an extraction unit 130. The learning unit 110 generates, by using learning data, a parser rule for extracting a target character string from data, the target character string being a character string including specific information. The extraction unit 130 extracts the target character string from data by using the parser rule.

Abstract: Provided is a process control device, etc. capable of more reliably maintaining the soundness of an information processing system with regard to cybersecurity. A processing control device calculates a sum of a value indicating a risk included in processing information that includes one or more processing executed on an information processing apparatus during a certain period; and restricts processing to the information processing apparatus when the calculated sum value for the processing information satisfies a predetermined restriction condition.

Abstract: Provided is an analysis system configured to obtain an encryption key for encryption communication between an information communication apparatus and a communication network, from memory space provided in the information communication apparatus.

Abstract: A category information generating apparatus generates a measurement identifier of a measured value with respect to measurement information where the measured value for communication and a resource identifier of an apparatus generating the measured value are associated; extracts, when the resource identifier in the measurement information satisfies a condition regarding the resource identifier in extracted information where a condition for the resource identifier, an extraction item representing an item extracted from the measurement information when the condition is satisfied, and an extracted information identifier of the extraction item are associated, a particular measured value associated with the resource identifier; reads a value representing an extraction item in the extracted information from the particular measured value; and generates category information where a measurement identifier representing the particular measured value, the extracted information identifier in the extracted information, and

Abstract: Provided is a communication network determination apparatus, etc. capable of correctly specifying a communication network which can be monitored by a monitoring device even when necessary and sufficient configuration information about the configuration of the communication network cannot be obtained.

Abstract: Provided are a communication destination determination device and the like in which a communication destination that is highly likely to pose a threat can be detected. A communication destination determination device 101 is provided with: a signal transmission unit 102 which transmits, when a first signal transmitted from a communication destination 104 is received via a communication network, a second signal in response to the first signal to the communication destination 104; and a communication destination determination unit 103 which classifies whether the communication destination 104 is highly likely to pose a threat or not, on the basis of whether or not a third signal transmitted from the communication destination 104 is received within a certain time period from the timing of transmission of the second signal.

Abstract: A category information generating apparatus generates a measurement identifier of a measured value with respect to measurement information where the measured value for communication and a resource identifier of an apparatus generating the measured value are associated; extracts, when the resource identifier in the measurement information satisfies a condition regarding the resource identifier in extracted information where a condition for the resource identifier, an extraction item representing an item extracted from the measurement information when the condition is satisfied, and an extracted information identifier of the extraction item are associated, a particular measured value associated with the resource identifier; reads a value representing an extraction item in the extracted information from the particular measured value; and generates category information where a measurement identifier representing the particular measured value, the extracted information identifier in the extracted information, and

Abstract: An information processing device includes: a memory; and at least one processor coupled to the memory. The processor performs operations. The operations include: extracting a transmission source of communication from communication data received by a predetermined device, and generating first data that include the transmission source and a time associated with communication and included in the communication data; and totaling a first frequency of reception of the communication data for the each transmission source, based on the first data, in each of a first period and a second period that includes the first period and is longer than the first period.

Abstract: Provided is an analysis apparatus including a first storage device configured to store data, and a processing circuitry that is configured to control the own apparatus to function as: a dispatcher that is communicably connected to an analysis target device that performs operational processing by use of a processor and a memory unit, and generates collection target data for reproducing at least part of a state of the operational processing in the analysis target device, in accordance with data being transmitted and received between the processor and the memory unit; a data mapper that assigns, to one or more areas included in the collection target data, tag information for identifying the area; and a data writer that saves the one or more areas into the first storage device in accordance with a first policy defining a procedure of saving the collection target data into the first storage device.

Abstract: An analysis system that is able to obtain correct encryption key is provided. The analysis system includes a processing circuitry configured to function as a cryptanalysis processing unit. The cryptanalysis processing unit includes: a key candidate extraction unit that is configured to extract, from second data, one or more candidates of key data that include an encryption key that enables to decrypt first data encrypted by a specific encryption scheme, based on data indicating a feature of the key data; and a decryption unit that is configured to extract, from the extracted candidates of key data, correct key data that enables to correctly decrypt the encrypted first data, based on a result of decrypting the first data by use of the extracted candidates of key data.

Abstract: Provided is an analysis system including a memory acquisition unit that is configured to acquire at least part of data stored in a memory unit in an information communication apparatus including a computing unit and the memory unit; a communication processing unit that is configured to instruct the memory acquisition unit to acquire data stored in the memory unit when determining that key data including an encryption key for cryptographic communication protocol are stored in the memory unit; and a cryptanalysis unit that is configured to extract one or more key data candidates that are candidates of the key data, from the stored in the memory unit, and extract, from one or more of the key data candidates, correct key data that enables to decrypt correctly the encrypted communication data. The communication processing unit is further configured to execute specific processing according to the decrypted communication data.

Abstract: Provided is an analysis apparatus including a first storage device configured to store data, and a processing circuitry that is configured to control the own apparatus to function as: a dispatcher that is communicably connected to an analysis target device that performs operational processing by use of a processor and a memory unit, and generates collection target data for reproducing at least part of a state of the operational processing in the analysis target device, in accordance with data being transmitted and received between the processor and the memory unit; a data mapper that assigns, to one or more areas included in the collection target data, tag information for identifying the area; and a data writer that saves the one or more areas into the first storage device in accordance with a first policy defining a procedure of saving the collection target data into the first storage device.

Abstract: Provided is a communication network determination apparatus, etc. capable of correctly specifying a communication network which can be monitored by a monitoring device even when necessary and sufficient configuration information about the configuration of the communication network cannot be obtained.

Abstract: Provided is a process control device, etc. capable of more reliably maintaining the soundness of an information processing system with regard to cybersecurity. A processing control device calculates a sum of a value indicating a risk included in processing information that includes one or more processing executed on an information processing apparatus during a certain period; and restricts processing to the information processing apparatus when the calculated sum value for the processing information satisfies a predetermined restriction condition.

Abstract: An information collection system for efficiently collecting target information from an enormous amount of contents in a variety of formats is provided. The information collection system 100 includes a learning unit 110 and an extraction unit 130. The learning unit 110 generates, by using learning data, a parser rule for extracting a target character string from data, the target character string being a character string including specific information. The extraction unit 130 extracts the target character string from data by using the parser rule.

Abstract: Provided is a log information generation apparatus and the like that generates log information where log of communication via a communication network are arranged in communication occurrence order. A log information generation apparatus provides time information including a second time in an information processing apparatus to a difference calculation apparatus in accordance with communication start information transmitted to a plurality of information processing apparatuses communicably connecting to a communication network at a start of communication processing via the communication network, the difference calculation apparatus calculating a difference between a input first time and a reference time; and generates log information associating arranged time with a content of communication processing, the arranged time obtained by arranging a time of the communication processing based on the difference calculated for the second time by the difference calculation apparatus.

Abstract: Provided are a communication destination determination device and the like in which a communication destination that is highly likely to pose a threat can be detected. A communication destination determination device 101 is provided with: a signal transmission unit 102 which transmits, when a first signal transmitted from a communication destination 104 is received via a communication network, a second signal in response to the first signal to the communication destination 104; and a communication destination determination unit 103 which classifies whether the communication destination 104 is highly likely to pose a threat or not, on the basis of whether or not a third signal transmitted from the communication destination 104 is received within a certain time period from the timing of transmission of the second signal.

Abstract: A communication information generating apparatus refers, in response to a request for extracting information satisfying a first condition of a first item included in a plurality of items measured for communication and a second condition of a second item included in the plurality of items, to item information where partial items included in the plurality of items measured with respect to communication are associated and specifies a third item associated with the first item and the second item; generates a command for extracting data satisfying the first condition with respect to the first item and the second condition with respect to the second item, transmits the generated command to an apparatus that manages values of a plurality of items of the communication, and receives data extracted in response to the command by the apparatus; and calculates values of the first item to the third item based on the received data.