Abstract: An anomaly detection device is provided with a learning unit that generates a detection model using a communication log during normal operation of a communication apparatus as learning data and an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model. The anomaly detection device is further provided with a data acquisition unit that acquires a communication log (second communication log) generated during a predetermined period later than a first communication log and a determination unit that instructs relearning using the second communication log when there is difference information between the learning data (first communication log) of the current detection model and the second communication log and when the number of pieces of additional information (information on the additional flow) or the number of pieces of deletion information (information on the delete flow) included in the difference information satisfies predetermined evaluation criteria.

Abstract: An anomaly detection device is provided with a learning unit that generates a detection model using a communication log during normal operation of a communication apparatus as learning data and an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model. The anomaly detection device is further provided with a data acquisition unit that acquires a communication log (second communication log) generated during a predetermined period later than a first communication log and a determination unit that instructs relearning using the second communication log when there is difference information between the learning data (first communication log) of the current detection model and the second communication log and when the number of pieces of additional information (information on the additional flow) or the number of pieces of deletion information (information on the delete flow) included in the difference information satisfies predetermined evaluation criteria.

Abstract: An acquisition unit acquires a communication feature for normal communication of communication equipment. If a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, an amplification unit amplifies the data count for the communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple. A creation unit creates, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature. A determination unit determines accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information.

Abstract: A generation device includes a memory, and processing circuitry coupled to the memory and configured to sense anomaly of a network based on information having a plurality of items related to communication in the network, identify a cause of anomaly corresponding to each piece of the information when anomaly is sensed, and generate, based on values of the items in the information and the cause of anomaly identified, a cause-of-anomaly pattern for each predetermined set of pieces of the information.

Abstract: An anomaly detection device is provided with a learning unit that generates a detection model using a communication log during normal operation of a communication apparatus as learning data and an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model. The anomaly detection device is further provided with a data acquisition unit that acquires a communication log (second communication log) generated during a predetermined period later than a first communication log and a determination unit that instructs relearning using the second communication log when there is difference information between the learning data (first communication log) of the current detection model and the second communication log and when the number of pieces of additional information (information on the additional flow) or the number of pieces of deletion information (information on the delete flow) included in the difference information satisfies predetermined evaluation criteria.

Abstract: A determination unit determines necessity of relearning of an initial learning model based on at least one of information regarding the initial learning model generated by learning initial learning data known to be normal, information regarding over-detection data over-detected by an abnormality detection system that uses the initial learning model, and information regarding an over-detection model generated based on the over-detection data. A notification unit notifies of determination result by determination unit.

Abstract: A communication system including an operational network including a host and a learning and detection server, and a staging network including a host of the same type as the host, a test execution server, and a learning and detection server. The test execution server performs a communication test by transmitting test communication in a normal state to the host and receiving communication performed by the host. The learning and detection server learns the communication of the host, generates an initial model for detecting an anomalous communication of the host, and transmits the initial model to the learning and detection server. The learning and detection server learns the communication of the host and generates a model for detecting an anomalous communication of the host, while monitoring the communication of the host using the initial model received from the learning and detection server.

Abstract: An acquisition unit acquires a communication feature for normal communication of communication equipment. If a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, an amplification unit amplifies the data count for the communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple. A creation unit creates, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature. A determination unit determines accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information.

Abstract: An anomaly detection device includes a memory, and processing circuitry coupled to the memory and configured to acquire communication feature values of communication devices, calculate, for each transmission source MAC address included in the communication feature values acquired, a total value of the number of transmitted and received packets or a total value of the number of bytes, for each layer-2 switch connected to a corresponding communication device, and determine, for each transmission source MAC address, that a communication device corresponding to the transmission source MAC address is connected to a layer-2 switch whose total value of the number of transmitted and received packets or total value of the number of bytes calculated is the largest.

Abstract: An anomaly detection device is provided with a learning unit that generates a detection model using a communication log during normal operation of a communication apparatus as learning data and an anomaly detection unit that detects anomaly of the communication apparatus using the generated detection model. The anomaly detection device is further provided with a data acquisition unit that acquires a communication log (second communication log) generated during a predetermined period later than a first communication log and a determination unit that instructs relearning using the second communication log when there is difference information between the learning data (first communication log) of the current detection model and the second communication log and when the number of pieces of additional information (information on the additional flow) or the number of pieces of deletion information (information on the delete flow) included in the difference information satisfies predetermined evaluation criteria.

Abstract: A generation device includes a memory, and processing circuitry coupled to the memory and configured to sense anomaly of a network based on information having a plurality of items related to communication in the network, identify a cause of anomaly corresponding to each piece of the information when anomaly is sensed, and generate, based on values of the items in the information and the cause of anomaly identified, a cause-of-anomaly pattern for each predetermined set of pieces of the information.

Abstract: An anomaly detection device includes a memory, and processing circuitry coupled to the memory and configured to acquire communication feature values of communication devices, calculate, for each transmission source MAC address included in the communication feature values acquired, a total value of the number of transmitted and received packets or a total value of the number of bytes, for each layer-2 switch connected to a corresponding communication device, and determine, for each transmission source MAC address, that a communication device corresponding to the transmission source MAC address is connected to a layer-2 switch whose total value of the number of transmitted and received packets or total value of the number of bytes calculated is the largest.

Abstract: A communication system including an operational network including a host and a learning and detection server, and a staging network including a host of the same type as the host, a test execution server, and a learning and detection server. The test execution server performs a communication test by transmitting test communication in a normal state to the host and receiving communication performed by the host. The learning and detection server learns the communication of the host, generates an initial model for detecting an anomalous communication of the host, and transmits the initial model to the learning and detection server. The learning and detection server learns the communication of the host and generates a model for detecting an anomalous communication of the host, while monitoring the communication of the host using the initial model received from the learning and detection server.

Abstract: The present invention is to prevent electrostatic breakdown or drying failure in a step of cleaning a backside of a semiconductor wafer, thereby improving reliability of a semiconductor device. A semiconductor wafer is rotated in a state where a backside of the semiconductor wafer is directed upward. A rinsing liquid is supplied to the backside of the semiconductor wafer from a nozzle to clean the same by a brush. During that time, a rinsing liquid is supplied to a surface of the semiconductor wafer from a nozzle disposed below that. At that time, a direction of spray of the rising liquid from the nozzle is set to be orthogonal to the surface of the semiconductor wafer, and a liquid flow of the rinsing liquid sprayed from the nozzle is applied to a position away from the center of the surface of the semiconductor wafer.