Abstract: A computer-implemented process for training a prediction model for survival analysis includes the following operations. A batch of data is elected from a training dataset representing a plurality of individuals. A curve representing a survival rate of a group of individuals within the batch over a period of time is generated using a non-parametric statistical function and for the batch of data. Individual survival functions for each individual within the batch are estimated using the prediction model. An average survival function is generated from the individual survival functions. A calibration loss is generated using the curve representing the survival rate and the average survival function. Weight of a neural network including the prediction model are updated based upon a total loss including the calibration loss.

Abstract: A method, which trains a neural network to perform an analysis that satisfies average calibration, includes a processor manipulating a data set that includes an outcomes vector and a set of feature vectors, each of which corresponds to one of the outcomes in the outcomes vector. The processor repeatedly: selects a subset of the set of feature vectors; generates a distribution vector for a subset of the outcomes vector that corresponds to the subset of the set of feature vectors; produces a prediction vector by running the neural network on the subset of the set of feature vectors; calculates a Bregman divergence between the distribution vector and a scoring distribution vector of the prediction vector; and updates weights of the neural network based on the Bregman divergence.

Abstract: An example operation may include one or more of storing chaincode comprising executable steps of a multi-party process generated from a state diagram in which a blockchain is an intermediary between a plurality of off-chain systems, receiving a request to execute the multi-party process, processing a step of the multi-party process based on the request via execution of the stored chaincode including the executable steps of the multi-party process to generate a processed result for the step, and storing an identification of the processed step and the generated processed result via a data block among a hash-linked chain of data blocks of the blockchain.

Abstract: A computer-implemented method is provided for automatically transforming a Business Process Model (BPM) into a hierarchical statechart. The BPM has parallel paths with at least one FORK node and at least one JOIN node. The method includes, responsive to identifying each of the at least one FORK node in the BPM in a node analysis: (i) generating a FORK edge sub-statechart having an initial state and a working state for each of edges from the at least one FORK node, and attaching the FORK edge sub-statechart to a hierarchical state for the at least one FORK node; and (ii) generating a synchronizer sub-statechart corresponding to each JOIN node going through the FORK node to receive a synchronization event from each FORK edge sub-statechart, and attaching the synchronizer sub-statechart to the hierarchical state for the at least one FORK node to form an intermediate version of the hierarchical statechart.

Abstract: An example operation may include one or more of receiving a plurality of state representations of a plurality of off-chain systems for performing a multi-party process via a blockchain, wherein each state representation identifies send and receive events of a respective off-chain system, removing one or more events from a state representation of an off-chain system to generate a reduced state representation, generating executable chaincode for the blockchain based on the plurality of state representations including the reduced state representation, and storing the generated chaincode via a blockchain node of the blockchain.

Abstract: An example operation may include one or more of connecting, by a template generator node, to a blockchain that includes a plurality of user peers, retrieving, by the template generator node, a contract file from a ledger of the blockchain, executing, by the template generator node, chaincode to: extract a plurality of portions of the contract file based on a structure of a contract, determine common portions among the plurality of the portions, determine typical portions of the contract file from the common portions, generate a template based on the typical portions, format the template based on a state chart, and storing, by the template generator node, the template onto the ledger of the blockchain for access by the plurality of the user peers.

Abstract: An example operation may include one or more of connecting, by a template generator node, to a blockchain that includes a plurality of user peers, retrieving, by the template generator node, a contract file from a ledger of the blockchain, executing, by the template generator node, chaincode to: extract a plurality of portions of the contract file based on a structure of a contract, determine common portions among the plurality of the portions, determine typical portions of the contract file from the common portions, generate a template based on the typical portions, format the template based on a state chart, and storing, by the template generator node, the template onto the ledger of the blockchain for access by the plurality of the user peers.

Abstract: An example operation may include one or more of storing chaincode comprising executable steps of a multi-party process generated from a state diagram in which a blockchain is an intermediary between a plurality of off-chain systems, receiving a request to execute the multi-party process, processing a step of the multi-party process based on the request via execution of the stored chaincode including the executable steps of the multi-party process to generate a processed result for the step, and storing an identification of the processed step and the generated processed result via a data block among a hash-linked chain of data blocks of the blockchain.

Abstract: An example operation may include one or more of receiving a plurality of state representations of a plurality of off-chain systems for performing a multi-party process via a blockchain, wherein each state representation identifies send and receive events of a respective off-chain system, removing one or more events from a state representation of an off-chain system to generate a reduced state representation, generating executable chaincode for the blockchain based on the plurality of state representations including the reduced state representation, and storing the generated chaincode via a blockchain node of the blockchain.

Abstract: A method is for handling an anomaly in an industrial control system (ICS) connected to a network with a plurality of other ICSs and an anomaly analyzer. An ICS receives status data from its own industrial process, and stores this status data as normal pattern data. The ICS transmits its own status data to one or more other ICSs. The ICS receives an indication from the anomaly analyzer that the ICS is suspected of having an anomaly. The ICS transmits alternate status data based on the normal pattern data stored during non-suspect operation, and stores the status data received from its own industrial process as real status data. In response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmits the stored real data, and switches back to transmitting its own status data to one or more other ICSs.

Abstract: An anomaly detection system for detecting an anomaly within a network as a first embodiment in order to provide an anomaly detection system, anomaly detection method, and program for the same. An anomaly detection system which has a plurality of industrial control systems (hereinafter “ICS”s) which are connected to the network, an integrated analyzer which receives the operational status of each ICS as monitoring data in order to identify an ICS for which an anomaly is suspected so as to perform an anomaly assessment, a receiving unit provided for each ICS which receives data from other ICSs, a transmission unit which transmits data to other ICSs and transmits the monitoring data to the integrated analyzer, a security policy which includes recording of data and generation rules, and a wrapper which refers to the security policy in order to control the data so as to transmit the same to other ICSs.

Abstract: An improved method and system for providing path-level access control to a structured document in a collection stored in a database, where the structured document includes a plurality of nodes is disclosed. The method includes the steps of providing an access control policy for the collection, where the access control policy comprises a plurality of access control rules, generating a path for each node of the plurality of nodes in the document, and generating for each path associated with a node a corresponding value expression based on at least one access control rule of the plurality of access control rules. According to the method and system of the present invention, the corresponding value expression is utilized during access control evaluation to determine whether a user is allowed to access a node in the structured document.

Abstract: An anomaly detection system for detecting an anomaly in a plurality of control systems comprises a plurality of analysis devices that are associated with the respective control systems and that acquire an event occurring in an associated control system and analyze the event to determine whether there is an anomaly. A first analysis device among the plurality of analysis devices determines whether an event occurring in the associated control system is to be indicated to a second analysis device among the plurality of analysis devices, and the second analysis device determines that there is an anomaly on condition that the event indicated by the first analysis device has correlation with an event indicated by an analysis device other than the first analysis device.

Abstract: An anomaly detection system for detecting an anomaly in a plurality of control systems comprises a plurality of analysis devices that are associated with the respective control systems and that acquire an event occurring in an associated control system and analyze the event to determine whether there is an anomaly. A first analysis device among the plurality of analysis devices determines whether an event occurring in the associated control system is to be indicated to a second analysis device among the plurality of analysis devices, and the second analysis device determines that there is an anomaly on condition that the event indicated by the first analysis device has correlation with an event indicated by an analysis device other than the first analysis device.

Abstract: A system for generating contexts of targets to estimate a high-order context is provided. The system includes: a detection device including: a sensor for detecting a target; a module for extracting the target and a primary context of the target based on data detected by the sensor; and a module for encrypting the primary context with a key corresponding to the target; a storage device for recording encrypted primary context from the detection device; and a processing device including: a module for receiving the encrypted primary context from the storage device; a module for receiving the key corresponding to the target involved in the encrypted primary context; a module for decrypting the encrypted primary context using the received key; and a module for estimating a high-order context using the decrypted primary context, where the processing device further includes a module for requesting the detection device to delete information on a key corresponding to a specific target.

Abstract: A method is for handling an anomaly in an industrial control system (ICS) connected to a network with a plurality of other ICSs and an anomaly analyzer. An ICS receives status data from its own industrial process, and stores this status data as normal pattern data. The ICS transmits its own status data to one or more other ICSs. The ICS receives an indication from the anomaly analyzer that the ICS is suspected of having an anomaly. The ICS transmits alternate status data based on the normal pattern data stored during non-suspect operation, and stores the status data received from its own industrial process as real status data. In response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmits the stored real data, and switches back to transmitting its own status data to one or more other ICSs.

Abstract: An improved method and system for providing path-level access control to a structured document in a collection stored in a database, where the structured document includes a plurality of nodes is disclosed. The method includes the steps of providing an access control policy for the collection, where the access control policy comprises a plurality of access control rules, generating a path for each node of the plurality of nodes in the document, and generating for each path associated with a node a corresponding value expression based on at least one access control rule of the plurality of access control rules. According to the method and system of the present invention, the corresponding value expression is utilized during access control evaluation to determine whether a user is allowed to access a node in the structured document.

Abstract: A communication control method and system for controlling communication among multiple industrial control systems connected via a network. The communication control system includes: a communication relay apparatus for relaying communication between at least two of multiple industrial control systems; a monitoring section for monitoring the multiple industrial control systems; and a control section for switching, if the monitoring section detects an anomaly from at least one of the multiple industrial control systems, communication between an industrial control system detected with an anomaly and a second industrial control system so that the communication is performed via the communication relay apparatus.

Abstract: An improved method and system for providing path-level access control to a structured document in a collection stored in a database, where the structured document includes a plurality of nodes is disclosed. The method includes the steps of providing an access control policy for the collection, where the access control policy comprises a plurality of access control rules, generating a path for each node of the plurality of nodes in the document, and generating for each path associated with a node a corresponding value expression based on at least one access control rule of the plurality of access control rules. According to the method and system of the present invention, the corresponding value expression is utilized during access control evaluation to determine whether a user is allowed to access a node in the structured document.

Abstract: A communication control method and system for controlling communication among multiple industrial control systems connected via a network. The communication control system includes: a communication relay apparatus for relaying communication between at least two of multiple industrial control systems; a monitoring section for monitoring the multiple industrial control systems; and a control section for switching, if the monitoring section detects an anomaly from at least one of the multiple industrial control systems, communication between an industrial control system detected with an anomaly and a second industrial control system so that the communication is performed via the communication relay apparatus.