Abstract: An estimation device includes processing circuitry configured to extract a fixed-length feature amount from a payload of communication data, calculate a similarity between feature amounts of abnormal communication data, and determine that events are of a same type when the calculated similarity is greater than a predetermined threshold.

Abstract: A traffic sensor includes processing circuitry configured to calculate a degree of spread of a range of normal communication indicated by a normal communication model for each of the normal communication model for detecting abnormal communication of an Internet of Things (IoT) device learned for each of the IoT device to be monitored, classify a normal communication model in which the degree of spread is less than a predetermined value as a normal communication model of an IoT device of a first model, and classify a normal communication model in which the degree of spread is equal to or greater than the predetermined value as a normal communication model of an IoT device of a second model, detect abnormal communication in the IoT device by using the normal communication model of the IoT device of the first model, and extract a feature amount.

Abstract: An analysis device includes processing circuitry configured to acquire, from each network traffic sensor that monitors communication of an Internet of Things (IoT) device, a normal communication model that is used for monitoring the communication and indicates a characteristic of normal communication of the IoT device, cluster a normal communication model group of a same feature among acquired normal communication model groups, calculate a majority cluster that is a cluster having a largest number of normal communication models by using a result of the clustering, and calculate an average model of the normal communication model group belonging to the majority cluster, and notify the network traffic sensor serving as an acquisition source of the normal communication model of attribution information indicating whether or not the normal communication model belongs to the majority cluster and the average model.

Abstract: A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.

Abstract: In a communication network system (1), each of a plurality of management devices (20) generates an individual whitelist, which is individually generated in each of a plurality of management devices (20), and is related to a communication destination of an IoT device (30A) connected to an own management device, and uploads a generated individual whitelist to a server device (10), the server device collects the plurality of individual whitelists uploaded from each of the plurality of management devices (20), generates an aggregated whitelist that is an aggregated result of the plurality of individual whitelists, and distributes the generated aggregated whitelist to each of the plurality of management devices (20), and each of the plurality of management devices (20) acquires the aggregated whitelist distributed from the server device (10), and updates the individual whitelist generated by an own management device based on the aggregated whitelist.

Abstract: Provided is an IoT GW (10), including a learning unit (131) configured to create, for each IoT device connected to the IoT GW (10), a normal communication model (122) that has learned a normal communication pattern of the IoT device; and a determination unit (132) configured to: determine, for learning by the learning unit (131), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit (131) based on a result of determination.

Abstract: Provided is an IoT GW (10), including a learning unit (131) configured to create, for each IoT device connected to the IoT GW (10), a normal communication model (122) that has learned a normal communication pattern of the IoT device; and a determination unit (132) configured to: determine, for learning by the learning unit (131), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit (131) based on a result of determination.

Abstract: A communication terminal apparatus includes processing circuitry configured to collect communication of an application and control the communication of the application based on a first control condition, analyze the communication collected to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

Abstract: A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.