Abstract: In an abnormality detection method, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets are calculated, a feature amount of the detection target packet stream is extracted using the plurality of distances calculated, and information about the degree of abnormality in the detection target packet stream is calculated using the extracted feature amount.

Abstract: An anomaly detection system includes: a register value collector that collects register values of register numbers from a controller; a future state predictor that predicts a future state of the control system; a blacklist creator that creates a blacklist based on a prediction result; an anomaly determiner that determines whether the control system enters an anomalous state by checking the collected register values against the blacklist; and an outputter that outputs a determination result. The blacklist creator defines, as the blacklist: a predicted register number that is predicted, if a register value of the predicted register number is changed, to cause the control system to enter the anomalous state in the future; and a range of the register value within which the control system is predicted to enter the anomalous state, and dynamically creates the blacklist corresponding to a combination of the collected register values.

Abstract: A monitoring apparatus includes: a user input acquirer that acquires information based on input provided by a user to a user input device; and a communication anomaly detector that detects a communication anomaly in communication that is being observed, and the communication anomaly detector detects the communication anomaly based on information about a packet whose source or destination includes a monitoring target device and the information based on the input corresponding to the packet.

Abstract: An anomaly detection method includes: calculating, for a detection target data stream of consecutive detection target data, distances between the detection target data; extracting features of the detection target data stream using the calculated distances; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using the extracted features. Each extracted feature is made up of L consecutive distances (L is an integer greater than or equal to 2). For each feature extracted, supplementary information for calculating the anomaly degree information is calculated using a difference in the feature. For each of one or more information calculation target windows made up of N detection target data (N is an integer greater than or equal to L+1), the anomaly degree information is calculated using all supplementary information calculated from the N detection target data.

Abstract: This method includes: extracting, from communication in a network, a first communication triplet that is a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating the type of communication performed between devices; determining whether the first communication triplet extracted corresponds to any of a plurality of second communication triplets stored in storage in advance as a whitelist and each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating the type of communication; and estimating, as a score, a possibility that the first communication triplet emerges as the communication, by using a model that has been trained, when the first communication triplet does not correspond to any of the plurality of second communication triplets.

Abstract: A communication security apparatus includes a communicator that receives a packet from a first device and transmits the received packet to a second device, a memory that retains address authentication information containing pairs of a physical address and a logical address of one or more devices, and a controller. After a learning period of receiving and transmitting packets, the controller determines whether a pair of a physical address and a logical address of the first device and the second device match any one of the pairs of the physical address and the logical address of the one or more devices in the packet, and discards the packet when the pair of the physical address and the logical address of the first device and the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices.

Abstract: A method of obtaining a shared prediction model is provided. The method includes: obtaining a prediction model as a neural network; converting each negative numerical value in a plurality of parameters included in the prediction model to a positive numerical value to obtain a converted prediction model; and sharing the converted prediction model by a secret sharing method to obtain shared prediction models while concealing an input data.

Abstract: An information processing method performed by an information processing system including a storage device to process a plurality of data frames flowing in an in-vehicle network including at least one electronic control unit includes a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network, a frame collection step of recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information, a feature acquisition step of acquiring, from the reception interval information, a feature relating to distribution of the reception intervals between the plurality of data frames, and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames.

Abstract: A secure authentication method includes: deriving a distributed LSH value using secret LSH, taking a first distributed feature amount which is a feature amount of user information distributed through a secret distribution method and encrypted LSH parameters as inputs; deriving a distributed hash value using a secret unidirectional function, taking the distributed LSH value and a distributed key as inputs; decoding the hash value by reversing distribution of the distributed hash value; selecting, from a secret hash table storing sets of a hash value as an index and a distributed feature amount as a data string, a set including a hash value matching the decoded hash value; computing, in secret, similarity between the distributed feature amount in the set and the first distributed feature amount; deriving, in secret, a user authentication result based on the similarity computed; and outputting the derived authentication result.

Abstract: An anomaly detection method includes: calculating, for a detection target data stream of consecutive detection target data, distances between the detection target data; extracting features of the detection target data stream using the calculated distances; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using the extracted features. Each extracted feature is made up of L consecutive distances (L is an integer greater than or equal to 2). For each feature extracted, supplementary information for calculating the anomaly degree information is calculated using a difference in the feature. For each of one or more information calculation target windows made up of N detection target data (N is an integer greater than or equal to L+1), the anomaly degree information is calculated using all supplementary information calculated from the N detection target data.

Abstract: A prediction model conversion method includes: converting a prediction model by converting at least one parameter which is included in the prediction model and is for performing homogenization processing into at least one parameter for performing processing including nonlinear processing, the prediction model being a neural network; and generating an encrypted prediction model that performs prediction processing with input in a secret state remaining secret by encrypting the prediction model that has been converted.

Abstract: In an abnormality detection method, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets are calculated, a feature amount of the detection target packet stream is extracted using the plurality of distances calculated, and information about the degree of abnormality in the detection target packet stream is calculated using the extracted feature amount.

Abstract: A communication security apparatus includes a communicator that receives a packet from a first device and transmits the received packet to a second device, a memory that retains address authentication information containing pairs of a physical address and a logical address of one or more devices, and a controller. After a learning period of receiving and transmitting packets, the controller determines whether a pair of a physical address and a logical address of the first device and the second device match any one of the pairs of the physical address and the logical address of the one or more devices in the packet, and discards the packet when the pair of the physical address and the logical address of the first device and the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices.

Abstract: An information processing method performed by an information processing system including a storage device to process a plurality of data frames flowing in an in-vehicle network including at least one electronic control unit includes a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network, a frame collection step of recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information, a feature acquisition step of acquiring, from the reception interval information, a feature relating to distribution of the reception intervals between the plurality of data frames, and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames.

Abstract: A secure hub as a communication security apparatus includes a port that receives a packet from a device and transmits the packet to another device. The secure hub also includes a storage area that retains address authentication information containing pairs of a physical address and a logical address of one or more devices. The secure hub further includes a transfer processing unit that determines whether the pair of the physical address and the logical address of the device, and the pair of the another device, each match any pair of the one or more devices when the address authentication information contains the physical address or the logical address of the device and the another device contained in the packet, and discards the packet when the pair of the device and the pair of the another device do not match any of the pairs of the one or more devices.

Abstract: A network protection device includes a packet capture unit which captures a network packet through an intelligent switch which performs connection in a communication network or across communication networks; a network analyzer which detects a threat in the network packet; a threat remover which removes the threat in the network packet; and a switch operator which changes from a first communication path, which connects a sender node to a receiver node without the threat remover, to a second communication path, which is different from the first communication path and connects the sender node to the receiver node through the threat remover when the threat is detected in the threat detector.

Abstract: An information processing method performed by an information processing system including a storage device to process a plurality of data frames flowing in an in-vehicle network including at least one electronic control unit includes a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network, a frame collection step of recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information, a feature acquisition step of acquiring, from the reception interval information, a feature relating to distribution of the reception intervals between the plurality of data frames, and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames.

Abstract: There is provided an anomaly diagnosis method performed by an anomaly diagnosis apparatus that diagnosis to determine whether an observed value composed of values of variables representing a state of a monitoring target obtained by observing the monitoring target is anomalous. The anomaly diagnosis apparatus includes a processor and a memory. The memory stores an anomaly detection model generated by learning using observed values. The processor acquires group information indicating one or more groups each constituted by a combination of at least two mutually-related variables, acquires the observed value, determines whether the observed value is anomalous by employing the anomaly detection model read from the memory, and in a case where the observed value is determined to be anomalous, identifies a group causing an anomaly among the one or more groups in the observed value.

Abstract: An anomaly detection method includes: extracting, for each of a plurality of learning packets obtained, all possible combinations of N-grams in the payload included in the learning packet; counting a first number which is the number of occurrences of each combination in the payloads of the learning packets; calculating, as anomaly detection models, first probabilities by performing smoothing processing based on a plurality of the first numbers; and when the score calculated for each of a plurality of packets exceeds a predetermined threshold that is based on the anomaly detection models stored in a memory, outputting information indicating that the packet having the score has an anomaly.

Abstract: An integration server manages production in a manufacturing line that includes a first stage and a second stage carried out after the first stage. The integration server includes a communicator that acquires a first production log and a second production log. The first production log includes a first production count of processing objects in the first stage. The second production log includes the number of processing objects in the second stage. The integration server also includes an irregularity detector that detects the presence of irregularity in the first production log and the second production log on the basis of the first production count and the number of the processing objects in the second stage.