Abstract: An unauthorized access prevention system that includes a search unit searching the flowing-in path of the unauthorized access to the services by a Web system disclosed by a user's ISP, a determination unit determining the place to implement a countermeasure for protecting the services from the unauthorized access based on the result of the search, and a notification unit notifying, according to a determination that that the countermeasure is implemented in the flow source that makes the unauthorized access flow into the user's communication network, the determination to the flow source.

Abstract: An unauthorized access prevention system includes a countermeasure method determination unit determining a method of taking countermeasures to protect a destination against unauthorized access based on a rate indicating a probability that predetermined traffic is unauthorized access. The rate is determined by calculating a number of times that the countermeasures were taken and subtracting a number of times that countermeasures were suspended, and dividing the resultant number of times that countermeasures were taken without suspension by the number of times that countermeasures were taken, for the predetermined traffic. The system also includes a storage device storing the number of times that countermeasures were taken and the number of times that countermeasures were taken without suspension. A countermeasure execution control unit controls when to take the countermeasures in the determined method.

Abstract: A malicious access-detecting apparatus which is cable of grasping the whole aspect of an attack which can occur, before it actually occurs. A monitoring information-collecting section collects monitoring information including the network events detected by the monitoring devices on networks. A malicious apparatus group-deriving section retrieves a corresponding piece of the event information from an event information storage device, and derives, based on the retrieved piece of the event information, apparatuses that are involved in relevant detected network events which belong to the predetermined type of network events and of which addresses of senders or recipients are same, as a malicious apparatus group involved in the predetermined type of malicious access. A storage section stores information on each derived malicious apparatus group. An output section outputs a list of the each derived malicious apparatus group.

Abstract: This invention is to minimize influence to other network by preventing unauthorized accesses such as DDoS attacks and probing by worms. When the blocking apparatuses 10a and 10b detect outbound packets by the DDoS attacks or by the probing by the worm, they carry out the Egress filtering for such outbound packets to prevent the packets relating to the unauthorized access from being sent to the backbone network 1000. Moreover, because a notice to the effect that the unauthorized access is detected is sent to other blocking apparatuses 10c and 10d via the management apparatus 16, for example, the blocking apparatuses 10c and 10d precautionarily carry out the Ingress filtering to prevent the packets relating to the unauthorized access from being sent to the network C and D.

Abstract: An unauthorized access detection device capable of detecting unauthorized accesses which are made through preparation, in real time. When a packet travels on a network, a key data extractor obtains the packet and obtains key data. Next an ongoing scenario detector searches an ongoing scenario storage unit for an ongoing scenario with the key data as search keys. A check unit determines whether the execution of the process indicated by the packet after the ongoing scenario detected by the ongoing scenario detector follows an unauthorized access scenario being stored in an unauthorized access scenario storage unit. Then a report output unit outputs an unauthorized access report depending on the check result of the check unit.

Abstract: A cooperative application starter program that makes it easy to register a cooperative application and change a registration regarding the cooperative application. In an integrated management server, a correspondence information generation section obtains unit management information and generates correspondence information by which cooperative applications are associated with application servers and units. A menu setting section generates start definition information for starting the cooperative applications by using the correspondence information and associates the start definition information with operation menus. The operation menus and the start definition information are generated according to the units. When any of the units is selected, an auxiliary menu execution section starts a cooperative application by using start definition information set for the unit selected.

Abstract: A malicious access-detecting apparatus which is cable of grasping the whole aspect of an attack which can occur, before it actually occurs. A monitoring information-collecting section collects monitoring information including the network events detected by the monitoring devices on networks. A malicious apparatus group-deriving section retrieves a corresponding piece of the event information from an event information storage device, and derives, based on the retrieved piece of the event information, apparatuses that are involved in relevant detected network events which belong to the predetermined type of network events and of which addresses of senders or recipients are same, as a malicious apparatus group involved in the predetermined type of malicious access. A storage section stores information on each derived malicious apparatus group. An output section outputs a list of the each derived malicious apparatus group.

Abstract: This invention is to minimize influence to other network by preventing unauthorized accesses such as DDoS attacks and probing by worms. When the blocking apparatuses 10a and 10b detect outbound packets by the DDoS attacks or by the probing by the worm, they carry out the Egress filtering for such outbound packets to prevent the packets relating to the unauthorized access from being sent to the backbone network 1000. Moreover, because a notice to the effect that the unauthorized access is detected is sent to other blocking apparatuses 10c and 10d via the management apparatus 16, for example, the blocking apparatuses 10c and 10d precautionarily carry out the Ingress filtering to prevent the packets relating to the unauthorized access from being sent to the network C and D.

Abstract: An unauthorized access detection device capable of detecting unauthorized accesses which are made through preparation, in real time. When a packet travels on a network, a key data extractor obtains the packet and obtains key data. Next an ongoing scenario detector searches an ongoing scenario storage unit for an ongoing scenario with the key data as search keys. A check unit determines whether the execution of the process indicated by the packet after the ongoing scenario detected by the ongoing scenario detector follows an unauthorized access scenario being stored in an unauthorized access scenario storage unit. Then a report output unit outputs an unauthorized access report depending on the check result of the check unit.

Abstract: An unauthorized access prevention system includes a countermeasure execution status screen generation unit, a countermeasure execution instruction obtaining unit, and a countermeasure execution control unit. With the configuration, the countermeasure execution status screen generation unit generates a screen on which a case where countermeasures are being taken to protect a destination against unauthorized access in traffic entering a predetermined position on a communications network can be identified. The countermeasure execution instruction obtaining unit obtains an instruction to take the countermeasures to be taken for each type of traffic or an instruction to suspend the countermeasures being taken. The countermeasure execution control unit controls to take the countermeasures or to suspend the countermeasures at the instruction.

Abstract: An unauthorized access prevention system that includes a search unit searching the flowing-in path of the unauthorized access to the services by a Web system disclosed by a user's ISP, a determination unit determining the place to implement a countermeasure for protecting the services from the unauthorized access based on the result of the search, and a notification unit notifying, according to a determination that that the countermeasure is implemented in the flow source that makes the unauthorized access flow into the user's communication network, the determination to the flow source.

Abstract: The filtering system includes the incorrect request database that stores patterns of incorrect accesses to the Web server. The estimation unit that estimates the correctness of an access request from a client device based on the patterns stored in the incorrect request database and a predetermined estimation rule. The decision unit decides whether the access request is to be passed to the Web server based on the result of estimation by the estimation unit and a predetermined decision rule.

Abstract: A filtering apparatus includes an illegal request DB (database) which stores patterns of illegal accesses to a Web server, an estimation section which estimates the legality of an access request from a client device based on the illegal access patterns stored in the illegal request DB and on a predetermined estimation rule, and a determination section which determines whether the access request is to be transmitted to the Web server based on an estimation result of the estimation section and on a predetermined determination rule.