Abstract: A surveillance device according to the present invention includes: a memory; and at least one processor coupled to the memory. The processor performs operations. The operations includes: calculating, based on a value of a parameter that is contained in a received data frame and represents a state of an apparatus, a change in the state of the apparatus; and determining whether the change is included in an allowable range determined in accordance with the state of the apparatus before the change.

Abstract: An estimation apparatus 1 includes: a normal index estimation unit 2 configured to estimate, using a second variable output by a second component 21 that influences a first variable output by a first component 21, an index A indicating that the first variable is achieved at a normal time; and an abnormality propagation information estimation unit 3 configured to estimate abnormality propagation information expressing an index indicating that an abnormality propagates to a third variable output by a third component 21 influenced by the first component 21, by changing the first variable.

Abstract: An extraction device includes: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to: sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle; and extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle.

Abstract: An information processing device according to an aspect of the present disclosure includes: at least one memory; and at least one processor configured to execute instructions to: acquire a plurality of parameters indicating a state of a device; and extract a combination including two or more parameters from the plurality of parameters based on a dependency relationship between two parameters among the plurality of parameters.

Abstract: An anomaly detection apparatus 1 includes a period specification unit 2 that, at the time of learning, classifies learning packets by type, and, with use of a packet interval calculated for every packet type and a frequency indicating an incidence rate of the packet interval, specifies a period of the packet type, and a feature extraction unit 3 that extracts, based on the period, a sequence feature amount having sequence information indicating the order of the packet types and information indicating the time distribution between packets in the sequence information.

Abstract: An extraction apparatus can obtain a first alert and a second alert that are generated, when an anomaly occurs in a control system, in order to provide notification of the anomaly. The extraction apparatus includes: a classification unit configured to generate association information associating the first alert with the second alert; a learning unit configured to learn a generation pattern of the second alert when the anomaly occurs due to a cause other than a cyber-attack based on the association information generated by the classification unit and a generation pattern of the first alert when the anomaly occurs due to a cause other than a cyber-attack; and an extraction unit configured to extract, from among the second alerts, the second alert generated due to a cyber-attack based on the generation pattern of the second alert that is learned by the learning unit and output the extracted second alert.

Abstract: An estimation apparatus 1 includes: a correlation index estimation unit 2 configured to receive a variable output by a component 21 as an input, and estimate correlation index information indicating a range that a value of the variable and a correlation can take after a predetermined time, at a normal time; an abnormality degree calculation unit 3 configured to calculate an abnormality degree using the correlation index information; and a causal effect estimation unit 4 configured to estimate a causal effect expressing an index indicating that an abnormality propagates to a variable output by the component 21.

Abstract: An estimation apparatus 1 includes: a normal index estimation unit 2 configured to estimate, using a second variable output by a second component 21 that influences a first variable output by a first component 21, an index A indicating that the first variable is achieved at a normal time; and an abnormality propagation information estimation unit 3 configured to estimate abnormality propagation information expressing an index indicating that an abnormality propagates to a third variable output by a third component 21 influenced by the first component 21, by changing the first variable.

Abstract: An information processing apparatus according to the present invention includes a generation unit configured to generate the allowable range of a possible value of data measured from a target system based on a model for predicting the data measured in the target system and the data having been measured from the target system; and a detection unit configured to detect the state of the target system based on the data measured from the target system and the allowable range.

Abstract: A device management system includes a learning unit 81 for learning a state model representing a normal state of a system including a control target device, based on a control sequence representing one or more time-series commands and data indicating a state of the control target device when the control sequence is issued.

Abstract: A surveillance device according to the present invention includes: a memory; and at least one processor coupled to the memory. The processor performs operations. The operations includes: calculating, based on a value of a parameter that is contained in a received data frame and represents a state of an apparatus, a change in the state of the apparatus; and determining whether the change is included in an allowable range determined in accordance with the state of the apparatus before the change.

Abstract: An extraction device includes: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to: sort each set of frames that have the same identifier associated with a node, into frames maintaining a cycle and frames out of the cycle; and extract, as an event rule, a feature of a bit change in a data field related to an event occurrence, from the frames that have the same identifier and are out of the cycle.

Abstract: An extraction apparatus (1) can obtain a first alert and a second alert that are generated, when an anomaly occurs in a control system, in order to provide notification of the anomaly. The extraction apparatus (1) includes: a classification unit (10) configured to generate association information associating the first alert with the second alert; a learning unit (20) configured to learn a generation pattern of the second alert when the anomaly occurs due to a cause other than a cyber-attack based on the association information generated by the classification unit (10) and a generation pattern of the first alert when the anomaly occurs due to a cause other than a cyber-attack; and an extraction unit (30) configured to extract, from among the second alerts, the second alert generated due to a cyber-attack based on the generation pattern of the second alert that is learned by the learning unit (20) and output the extracted second alert.

Abstract: An information processing device includes: an acquisition unit that acquires a communication packet used for monitoring and controlling a system and process data collected from an apparatus installed in the system via a network; and a detection unit that detects an abnormal communication pattern on the network based on a correspondence between a communication pattern related to the communication packet and the process data.

Abstract: In order to settle a problem of suppressing degradation of a throughput of a communication system, a communication device is provided with a reception means which receives and accumulates a first datum which a first device transmits addressing a second device and a second datum which the second device transmits, a transmission means which transmits the first datum to the second device, a quality index acquisition means which acquires a first index which is a quality of communication between the first device and the second device and a second index which is a quality of communication between the communication device and the second device, and a judgment means which forces to transmit the accumulated first datum to the second device using the transmission means in the case of judging that the second index is better than the first index and a reception condition of the second datum shows that the second device does not receive normally the first datum.

Abstract: A path control system according to the present invention includes a network including a communication device (202) that communicates via a radio link that uses adaptive modulation, and a path control device (201) predicting a future modulation mode for the radio link and setting a communication path for the network based on a predicted mode that is the predicted modulation mode.

Abstract: There is provided a packet joining method, program, and apparatus with an increased wireless utilization efficiency and a reduced packet delay.

Abstract: A radio communication method, a radio communication system and a wireless terminal by which low power consumption and the flexibility of a network can be realized. A base station and wireless terminals change an intermittent receive period and the preamble length of data on the basis of characteristics of the multihop radio network to carry out the intermittent receiving of data. Thus, a wireless terminal relaying data can receive the data reliably and a useless boot-up of a receiving part and standby time can be largely reduced to achieve low power consumption.

Abstract: The present invention is to provide a wireless communication system that is capable of preventing occurrence of radio interference caused by radio wave used by a radio wave generator without requiring any improvement of existing wireless devices. The wireless communication system of the present invention includes: a radio wave generator (1) that uses at least a radio wave in a frequency band that overlaps a frequency band used by a wireless standard; and wireless devices (AP, STA) each of which uses a radio wave conforming to the wireless standard. The radio wave generator (1) transmits a dummy frame conforming to the wireless standard to the wireless devices near the radio wave generator (1) before generating the radio wave in the same frequency band as the frequency band used by the wireless standard.

Abstract: In order to settle a problem of suppressing degradation of a throughput of a communication system, a communication device is provided with a reception means which receives and accumulates a first datum which a first device transmits addressing a second device and a second datum which the second device transmits, a transmission means which transmits the first datum to the second device, a quality index acquisition means which acquires a first index which is a quality of communication between the first device and the second device and a second index which is a quality of communication between the communication device and the second device, and a judgment means which forces to transmit the accumulated first datum to the second device using the transmission means in the case of judging that the second index is better than the first index and a reception condition of the second datum shows that the second device does not receive normally the first datum.