Abstract: In a priority determination apparatus (10), a dissimilarity index calculation unit (11) calculates a dissimilarity index between a transmission/reception performance record of a first traffic flow related to a first security alert notified from a network-type intrusion detection apparatus and a transmission/reception performance record of a second traffic flow related to a second security alert notified from the network-type intrusion detection apparatus in the past, the network-type intrusion detection apparatus being configured to detect an attack on an apparatus in a network. A priority determination unit (12) determines a priority of the first security alert based on the dissimilarity index calculated by the dissimilarity index calculation unit (11).

Abstract: A suspicious communication detection apparatus includes: a database; a machine learning model that receives features of an encrypted communication and that determines whether the encrypted communication is a suspicious communication; a determination part that refers to the database by using information about a received encrypted communication, enters obtained features about the received encrypted communication to the machine learning model, determines whether the received encrypted communication is a suspicious communication, and stores the determination result for the suspiciousness in the database; and a redetermination part that performs, based on a determination result of an encrypted communication from the inside of the organization to the outside of the organization, a redetermination on a determination result of an encrypted communication from the outside of the organization to the inside of the organization, the determination result being stored in the database.

Abstract: A suspicious communication detection apparatus includes: a database; a registration part that determines whether a received communication is an encrypted communication or a non-encrypted communication, performs padding on transmission and reception size values and transmission and reception packet numbers of the non-encrypted communication to fill in a difference from an encrypted communication, generates features from the non-encrypted communication obtained after the padding, and registers the features in the database; a learning part that trains a machine learning model by using features of non-encrypted communications registered in the database as training data, wherein the machine learning model receives features of an encrypted communication, and determines whether the encrypted communication is suspicious; and a determination part that refers to the database by using information about a received encrypted communication, enters obtained features about the received encrypted communication to the machine

Abstract: A processing device acquires a value of a first kind transmission performance index and a value of a second kind transmission performance index of each of a plurality of failed attack traffics being associated with a failed attack on an apparatus in a network, and a value of the first kind transmission performance index and a value of the second kind transmission performance index of each of a plurality of successful attack traffics being associated with a successful attack; and forms first attacked distribution information including information about a plurality of areas including a failed attack area and a successful attack area based on a value of the first kind transmission performance index and a value of the second kind transmission performance index for the plurality of failed attack traffics and the plurality of successful attack traffics.

Abstract: In a priority determination apparatus (10), a dissimilarity index calculation unit (11) calculates a dissimilarity index between a transmission/reception performance record of a first traffic flow related to a first security alert notified from a network-type intrusion detection apparatus and a transmission/reception performance record of a second traffic flow related to a second security alert notified from the network-type intrusion detection apparatus in the past, the network-type intrusion detection apparatus being configured to detect an attack on an apparatus in a network. A priority determination unit (12) determines a priority of the first security alert based on the dissimilarity index calculated by the dissimilarity index calculation unit (11).

Abstract: Provided is a data analysis support apparatus 1 that includes: a relationship score calculation unit 2 configured to calculate, with respect to a combination of features extracted from target data, a relationship score indicating a relationship between pieces of data corresponding to respective features included in the combination; a visualization score calculation unit 3 configured to calculate a visualization score indicating an effectiveness of a visualization method corresponding to the combination using the relationship score corresponding to the combination; and a display information generation unit 4 configured to select the visualization method according to the visualization score, and generate visualization display information for displaying a display corresponding to the selected visualization method on the display device 22.