Abstract: A computer system comprises an analysis module configured to execute dynamic analysis for a sample of a malicious program, and to output an analysis result including a coupling destination to and from which the malicious program communicates; a variation detection module configured to detect variation of the coupling destination based on results of cyclic observation of the coupling destination, and to output a result of the detection; and an information sharing module configured to store information output from the analysis module and information output from the variation detection module in a form that allows sharing among a plurality of external computers.

Abstract: A monitoring apparatus include a memory which stores a program for executing procedures and a processor coupled to the memory and executes the procedures based on the program, wherein the procedures includes detecting a destination of access from a server apparatus to a storage apparatus on the basis of a result of analysis of a packet transmitted and received between the storage apparatus and the server apparatus, the storage apparatus including a plurality of storage areas, the server apparatus executing a plurality of virtual servers, part of the plurality of storage areas being allocated to each of the plurality of virtual servers as an accessible storage area, and determining that abnormal access is performed from the server apparatus to the storage apparatus when the storage areas of the detected destination are beyond a certain criterion in the plurality of storage areas.

Abstract: A privilege violation detecting program stored on a computer-readable medium causes a computer to detect a privilege violation of an test target program by receiving an authority request API from an authority request API trace log storing unit; reading out, from an object access rule storing unit, an assumed access API assumed to be output in response to the received authority request API; determining an actual access API returned in response to the received authority request API from the actual access API trace log storing unit; and storing, into a least privilege violation data storing unit, data of the received authority request API when the actual access API returned in response received authority request API does not match the read out assumed access API.

Abstract: A management device includes an authentication unit and a control unit. If authentication information is received from a first device, the authentication unit included in the management device authenticates the received authentication information by using multiple pieces of authentication information that are stored in the first storing unit. If the authentication performed by the authentication unit is successful, the control unit included in the management device executes a login to the second device by using a single piece of login information that is stored in the second storing unit.

Abstract: A monitoring apparatus include a memory which stores a program for executing procedures and a processor coupled to the memory and executes the procedures based on the program, wherein the procedures includes detecting a destination of access from a server apparatus to a storage apparatus on the basis of a result of analysis of a packet transmitted and received between the storage apparatus and the server apparatus, the storage apparatus including a plurality of storage areas, the server apparatus executing a plurality of virtual servers, part of the plurality of storage areas being allocated to each of the plurality of virtual servers as an accessible storage area, and determining that abnormal access is performed from the server apparatus to the storage apparatus when the storage areas of the detected destination are beyond a certain criterion in the plurality of storage areas.

Abstract: A privilege violation detecting program stored on a computer-readable medium causes a computer to detect a privilege violation of an test target program by receiving an authority request API from an authority request API trace log storing unit; reading out, from an object access rule storing unit, an assumed access API assumed to be output in response to the received authority request API; determining an actual access API returned in response to the received authority request API from the actual access API trace log storing unit; and storing, into a least privilege violation data storing unit, data of the received authority request API when the actual access API returned in response received authority request API does not match the read out assumed access API.

Abstract: A connection control method includes: a transmitting step of transmitting a request for provision of a function by a transmitting unit; a first storing step of storing a task involving information having a disclosure restriction set thereon, and the site of a support device that provides a function to support execution of the task by processing the information, the task being associated with the site of the support device; a first retrieving step of retrieving the site of the support device stored in the first storing step associated with the task to be supported in response to the request; and a controlling step of restricting connections with other devices by controlling the transmitting unit to transmit the request to the support device located at the site retrieved in the first retrieving step and not to transmit the request to the other devices when the request transmitted in the transmitting step is a request for a support for execution of the task.

Abstract: An electronic information name of electronic information prepared by attaching a version number of the electronic information with a unique appellation of the electronic information is distributed to users of electronic information. Based on this electronic information name, accesses to the electronic information are conducted. There is further provided a table for holding the version number of the electronic information, and the version number held in the table is changed such as by a locking request, a locking release request for the electronic information. Upon an access request to the electronic information, the version number included in the electronic information name is compared with the version number held in the table, so as to judge whether or not the access to the electronic information is to be permitted, to thereby conduct an exclusive access control of the electronic information.

Abstract: A system for managing a work flow functions efficiently at a high speed. To attain this, the system includes a plurality of work flow support units, and a work flow support unit management unit. The work flow support unit management unit determines which work flow support unit is to manage a work flow. At this time, the work flow support unit management unit refers to the load condition of each work flow support unit to instruct the work flow support unit indicating the smallest load state to manage work flows, thereby preventing the process load from concentrating on a specific work flow support unit.

Abstract: In a data interchange system that executes a series of process flows among plurality of process executing devices, each process executing device is provided with a unit for interchanging process executing data with other device, and a unit for interchanging with other device interprocess association information that associates a process executed by one device with a process executed by other device, and it performs interchanging of process executing data and of interprocess association information, for example, at a different timing that is not synchronized between both of them. Even a system that has no mechanism for associating processes with one another is thereby enabled to realize associating processes with one another.

Abstract: There are provided a threshold value storing unit for storing a threshold value set by a receiver for an additional value which becomes effective for the receiver when the receiver reads a piece of E-mail and an E-mail arrival notifying unit for, when the additional value which is appended to the the E-mail transmitted from a transmitter side exceeds the threshold value stored in the threshold value storing unit, notifying the receiver of the arrival of the E-mail so as to select the E-mail to which the additional value exceeding the threshold value is appended in order to induce the receiver to read the E-mail, by which it becomes possible for the E-mail receiver to select an appropriate piece of E-mail and it becomes possible for the transmitter to induce the receiver to select and read an advertisement or the like from among many pieces of E-mail.

Abstract: An electronic information name of electronic information prepared by attaching a version number of the electronic information with a unique appellation of the electronic information is distributed to users of electronic information. Based on this electronic information name, accesses to the electronic information are conducted. There is further provided a table for holding the version number of the electronic information, and the version number held in the table is changed such as by a locking request, a locking release request for the electronic information. Upon an access request to the electronic information, the version number included in the electronic information name is compared with the version number held in the table, so as to judge whether or not the access to the electronic information is to be permitted, to thereby conduct an exclusive access control of the electronic information.

Abstract: In a distributed client-server system a client is connected to an arbitrary server using a communication module common to a plurality of servers and it uses data, etc. of each server by switching over its connection. At this time basically there is no need for communication and the replication of data between the servers.

Abstract: A job model with which an organization model representing an organization structure, a document model representing a document structure, and a work model representing a work procedure are correlated, is stored independent from a service model defining each service. When a service is performed, with reference to the job model corresponding to the service model, a service executing module causes a tool control module to control a tool. Thus, the required service is accomplished.