Abstract: A vacuum processing apparatus includes a decompressable process container; a supply port configured to supply, to the process container, an ionic liquid that absorbs an oxidizing gas; and a discharge port configured to discharge the ionic liquid supplied to the process container. A recess is provided at a joint portion between members constituting the process container. The supply port is configured to supply the ionic liquid to the recess, and the discharge port is configured to discharge the ionic liquid supplied to the recess.

Abstract: A calculation device receives input of a plurality of pieces of training data including a communication destination known to be malignant as data. The calculation device generates a model that calculates a malignant degree of an input communication destination from each piece of the training data. The calculation device gives weight to each of the models, and generates a mixed model using the model and the weight. The calculation device calculates a malignant degree of a communication destination unknown whether the communication destination is malignant using the mixed model.

Abstract: An analysis device includes an input unit that receives input of communication destination information to be analyzed, a conversion unit that converts a partial character string included in the communication destination information into an image, a search unit that obtains a character string that is visually similar to an image converted by the conversion unit and searches for known communication destination information that is visually similar to the communication destination information based on the character string obtained, and an output unit that outputs a combination of the communication destination information and the known communication destination information that is visually similar to the communication destination information.

Abstract: An identification apparatus includes processing circuitry configured to determine whether or not a first image and a second image are similar based on feature points extracted from each of the first image and the second image, and determine whether or not the first image and the second image are similar by comparing neighborhood graphs generated for each of the first image and the second image, the feature points being as nodes.

Abstract: An inference device 10 converts configuration information of a network and information such as a security log into a predicate of the solution set programming. The inference device 10 obtains, as a solution set, a combination of predicates derived by a derivation rule from predicates obtained by conversion, and predicates not constrained by the constraint rule among predicates obtained by conversion using a method of solution set programming. The predicate of the solution set indicates, for example, whether a node included in the network is a client or a proxy.

Abstract: The detection device (10) has the signal processing unit (154) and the estimation unit (155). The signal processing unit (154) updates the evaluation value of the vertex of the graph by belief propagation, on the basis of the matrix generated using the argument on the complex plane expressing the direction of the side of the graph in which at least some vertices are labeled. The estimation unit (155) estimates a label of a vertex of the graph on the basis of the evaluation value.

Abstract: A detection device (10) converts each of a plurality of pieces of information on a network to a logical equation. The detection device (10) obtains an answer set satisfying a logical equation and an inference rule through inference. It is possible to detect change in a network configuration on the basis of the answer set.

Abstract: A specifying device receives an input of time-series information indicating an operation form of a domain name up to a predetermined date and time in time series. Then, the specifying device specifies a pattern of a time-series change in operation form of a domain name on the basis of pattern information indicating patterns of time-series change in operation form of the domain name and time-series information of an input domain name. The specifying device specifies candidates for the operation form of the domain name since the predetermined date and time using a result of the specifying. Thereafter, the specifying device determines whether or not the domain name is a target of a re-determination as to whether or not the domain name is a malicious domain name on the basis of the specified candidates for the operation form of the domain name since the predetermined date and time.

Abstract: The detection device (10) has the signal processing unit (154) and the estimation unit (155). The signal processing unit (154) updates the evaluation value of a vertex of the graph by random walk, on the basis of a matrix generated using the argument on the complex plane expressing the direction of the side of the graph in which at least some vertices are labeled. The estimation unit (155) estimates a label of a vertex of the graph on the basis of the evaluation value.

Abstract: An attack countermeasure determination includes a domain name input unit that receives any domain name as input, and acquires setting information corresponding to the domain name, registration information corresponding to the domain name, and external information corresponding to an internet protocol (IP) address corresponding to the domain name, as feature information on the domain name, an attack countermeasure determination unit that specifies a pre-designated category for the domain name on the basis of the feature information and determines, in a stepwise manner, an attack countermeasure against the domain name in accordance with the specified category, and an attack countermeasure information output unit that outputs attack countermeasure information corresponding to the attack countermeasure.

Abstract: A vulnerability determination apparatus includes processing circuitry configured to input URLs of a plurality of websites to be rehosted to a rehosting apparatus, the rehosting apparatus being configured to rehost the plurality of websites and display the plurality of websites on a user terminal, acquire a response to the input of the URLs from the rehosting apparatus, the response including contents and URLs of the plurality of websites after the rehosting, and identify, based on the acquired response, at least one of a URL set for each of the plurality of websites after the rehosting, presence or absence of a setting for writing a cookie in the plurality of websites, and presence or absence of a code for accessing a predetermined function of a browser in the plurality of websites and determine an attack that is likely to occur due to the rehosting of the plurality of websites.

Abstract: An inference method includes acquiring similarities between a domain name serving as an analysis object and each domain name indicated in a legitimate domain name list as feature amounts, and inferring a degree that the domain name serving as the analysis object is wrongly recognized as a legitimate domain name based on the feature amounts acquired at the acquiring and a training model that outputs, as a response to input of the feature amounts, a degree that the domain name serving as the analysis object is wrongly recognized as the legitimate domain name, by processing circuitry.

Abstract: A feature extraction unit extracts, from an advertising request to view an online advertisement, client information on a client as a transmission source of the advertising request and publisher information on a website of a publisher who displays advertising, and calculates a predetermined feature amount using the client information and the publisher information with respect to a plurality of advertising requests including at least a benign advertising request, and a determiner generation unit generates a determiner that determines whether an advertising request is malignant or not by using the calculated feature amount.

Abstract: A level estimation apparatus includes processing circuitry configured to receive event logs of events detected by a device or software, and calculate degrees of similarity among the events indicated by the event logs with use of the event logs, and estimate a level of a predetermined event based on the calculated degrees of similarity among the events and a level of at least one of the events, wherein in the calculation of the degrees of similarity among the events, when a degree of similarity between events detected by different devices or items of software is calculated, a degree of similarity to a common event is used, the common event being an event that has been detected mutually by the different devices or items of software.

Abstract: An identification apparatus includes processing circuitry configured to determine whether or not a first image and a second image are similar based on feature points extracted from each of the first image and the second image, and determine whether or not the first image and the second image are similar by comparing neighborhood graphs generated for each of the first image and the second image, the feature points being as nodes.

Abstract: A classification apparatus includes: a crawler unit that acquires access result data for a website, the access result data including website application information, web server information, and the like that are updated by an administrator of the website; an update history generation unit that generates an update history of the website by making comparison in chronological order between pieces of information included in the access result data for the website; a classifier generation unit that generates a classifier that classifies a website having a possibility of being abused in the future, by using, as a feature value, the update history of the website; and a classification unit that classifies, through the classifier generated, the website having the possibility of being abused in the future.

Abstract: In a vulnerability inspection device, an acquisition unit acquires system messages that are displayed in response to input for multiple types of service registration statuses of a user ID that is input to a login-related screen that requires input of the user ID in an account-based online service that issues the user ID. A determination unit uses the system messages that were acquired for the types to determine whether or not the login-related screen has a vulnerability regarding the leakage of user registration status.

Abstract: A conversion unit converts directions of edges between vertices in a graph to arguments on a complex plane. A generation unit generates a Hermitian matrix that represents a relationship between vertices in the graph by using the arguments converted by the conversion unit. A calculation unit calculates eigenvectors of the Hermitian matrix generated by the generation unit. A signal processing unit performs graph signal processing such as graph Fourier transform taking the eigenvectors calculated by the calculation unit to be a Fourier basis for a graph Laplacian.

Abstract: An extracting unit randomly extracts a block from among the blocks of instruction strings constituting the byte code of a first program and, at the time of execution of the first program, extracts the blocks which are invariably executed before the randomly-extracted block. A dividing unit randomly divides, into a plurality of blocks, the instruction strings constituting the byte code of a second program which enables detection of tampering of the first program. An inserting unit inserts the plurality of blocks, which are obtained by division by the dividing unit, at different positions in the block extracted by the extracting unit, while maintaining the execution sequence written in the second program.

Abstract: An identification device specifies a boundary which divides rows of IP addresses, which are included in an IP address block and sorted in a predetermined order, into a plurality of parts based on AS numbers, e2LDs, PTR records, etc. of the IP addresses. When the number of the IP addresses included in the part divided by the boundary is equal to or more than a parameter N, which can be arbitrarily set, an identification unit identifies the IP addresses included in the part as dynamic IP addresses.