Abstract: A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Abstract: An identification apparatus includes processing circuitry configured to determine whether or not a first image and a second image are similar based on feature points extracted from each of the first image and the second image, and determine whether or not the first image and the second image are similar by comparing neighborhood graphs generated for each of the first image and the second image, the feature points being as nodes.

Abstract: An inference device 10 converts configuration information of a network and information such as a security log into a predicate of the solution set programming. The inference device 10 obtains, as a solution set, a combination of predicates derived by a derivation rule from predicates obtained by conversion, and predicates not constrained by the constraint rule among predicates obtained by conversion using a method of solution set programming. The predicate of the solution set indicates, for example, whether a node included in the network is a client or a proxy.

Abstract: The detection device (10) has the signal processing unit (154) and the estimation unit (155). The signal processing unit (154) updates the evaluation value of the vertex of the graph by belief propagation, on the basis of the matrix generated using the argument on the complex plane expressing the direction of the side of the graph in which at least some vertices are labeled. The estimation unit (155) estimates a label of a vertex of the graph on the basis of the evaluation value.

Abstract: A detection device (10) converts each of a plurality of pieces of information on a network to a logical equation. The detection device (10) obtains an answer set satisfying a logical equation and an inference rule through inference. It is possible to detect change in a network configuration on the basis of the answer set.

Abstract: The detection device (10) has the signal processing unit (154) and the estimation unit (155). The signal processing unit (154) updates the evaluation value of a vertex of the graph by random walk, on the basis of a matrix generated using the argument on the complex plane expressing the direction of the side of the graph in which at least some vertices are labeled. The estimation unit (155) estimates a label of a vertex of the graph on the basis of the evaluation value.

Abstract: A level estimation apparatus includes processing circuitry configured to receive event logs of events detected by a device or software, and calculate degrees of similarity among the events indicated by the event logs with use of the event logs, and estimate a level of a predetermined event based on the calculated degrees of similarity among the events and a level of at least one of the events, wherein in the calculation of the degrees of similarity among the events, when a degree of similarity between events detected by different devices or items of software is calculated, a degree of similarity to a common event is used, the common event being an event that has been detected mutually by the different devices or items of software.

Abstract: An identification apparatus includes processing circuitry configured to determine whether or not a first image and a second image are similar based on feature points extracted from each of the first image and the second image, and determine whether or not the first image and the second image are similar by comparing neighborhood graphs generated for each of the first image and the second image, the feature points being as nodes.

Abstract: A conversion unit converts directions of edges between vertices in a graph to arguments on a complex plane. A generation unit generates a Hermitian matrix that represents a relationship between vertices in the graph by using the arguments converted by the conversion unit. A calculation unit calculates eigenvectors of the Hermitian matrix generated by the generation unit. A signal processing unit performs graph signal processing such as graph Fourier transform taking the eigenvectors calculated by the calculation unit to be a Fourier basis for a graph Laplacian.

Abstract: A detection device includes: an object data extraction unit that extracts, from one or more pieces of communication data which are transmitted from one or more electronic control units, at least part of a payload contained in communication data that satisfies a predetermined condition, information by which the communication interval between the communication data can be calculated, and a serial number of the communication data as object data; a partial sequence creation unit that creates, using the extracted object data, a partial sequence containing information corresponding to at least part of a payload and information indicating a communication interval from two or more pieces of object data with the same serial number; and a detection unit that detects, using the created partial sequence, predetermined communication data based on the order relation between at least part of a payload and the corresponding part of another payload and a communication interval.

Abstract: A classification apparatus that classifies sequential data, in which input communication destinations in a plurality of communications are recorded in order of occurrence of the communications, into a class that has a similar feature. There is a numerical vector calculation unit-configured to calculate numerical vectors that represent characteristics of communication destinations for each of the communication destinations, on the basis of sequential data in which the communication destinations in a plurality of communications are recorded in order of occurrence of the communications, and a classification unit-configured to classify the sequential data into a class that has a similar feature, on the basis of order relation of the communication destinations of the numerical vectors.

Abstract: A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Abstract: An access classification device includes: a processor configured to: construct a plurality of trees in each of which at least a first destination and a second destination are set as nodes, content information corresponding to the nodes is added to the nodes, and an instruction to transfer an access from the first destination to the second destination is set as an edge; associate nodes of the plurality of trees with each other for the plurality of trees constructed, based on similarity between local structures of the trees; calculate similarity between the nodes associated with each other in the plurality of trees, based on the content information added to the nodes, and calculate similarity between the plurality of trees using the calculated similarity between the nodes associated with each other; and classify the access into a set with similar features, based on the similarity calculated.

Abstract: A data classification device includes: a known data input unit that receives an input of known data, the known data being data already classified into a class and a subclass subordinate to the class; a feature extraction unit that extracts, from features included in the known data, a feature that causes classification of the known data belonging to the same class into a subclass using the feature to fail; and a classification unit that classifies classification target data into a class using the feature extracted by the feature extraction unit.

Abstract: A classification device constructs tree structure data in which attribute information relating to a single communication or multiple communications serves as a terminal node, from a series of communications with a single communication destination or multiple communication destinations that take place when software is executed, calculates attribute information on a higher node on the basis of attribute information on the terminal node, and classifies the software by specifying the type of the software on the basis of attribute information on the highest node.

Abstract: A detection device includes: an object data extraction unit that extracts, from one or more pieces of communication data which are transmitted from one or more electronic control units, at least part of a payload contained in communication data that satisfies a predetermined condition, information by which the communication interval between the communication data can be calculated, and a serial number of the communication data as object data; a partial sequence creation unit that creates, using the extracted object data, a partial sequence containing information corresponding to at least part of a payload and information indicating a communication interval from two or more pieces of object data with the same serial number; and a detection unit that detects, using the created partial sequence, predetermined communication data based on the order relation between at least part of a payload and the corresponding part of another payload and a communication interval.

Abstract: An access classifying device includes a tree building unit, a similarity-degree calculating unit, and a classifying unit. The tree building unit generates multiple trees, in which a first server and multiple second servers are nodes and commands for automatically transferring the sequence of accesses from the above-described first server to the above-described second servers are edges. The similarity-degree calculating unit calculates the degree of similarity between the above-described trees in accordance with the degree of matching between partial trees included in each of the above-described trees generated. The classifying unit classifies the above-described access in accordance with the above-described degree of similarity calculated.

Abstract: An access classification device includes: a processor configured to: construct a plurality of trees in each of which at least a first destination and a second destination are set as nodes, content information corresponding to the nodes is added to the nodes, and an instruction to transfer an access from the first destination to the second destination is set as an edge; associate nodes of the plurality of trees with each other for the plurality of trees constructed, based on similarity between local structures of the trees; calculate similarity between the nodes associated with each other in the plurality of trees, based on the content information added to the nodes, and calculate similarity between the plurality of trees using the calculated similarity between the nodes associated with each other; and classify the access into a set with similar features, based on the similarity calculated.

Abstract: A classification apparatus that classifies sequential data, in which input communication destinations in a plurality of communications are recorded in order of occurrence of the communications, into a class that has a similar feature. There is a numerical vector calculation unit-configured to calculate numerical vectors that represent characteristics of communication destinations for each of the communication destinations, on the basis of sequential data in which the communication destinations in a plurality of communications are recorded in order of occurrence of the communications, and a classification unit-configured to classify the sequential data into a class that has a similar feature, on the basis of order relation of the communication destinations of the numerical vectors.

Abstract: A classification device constructs tree structure data in which attribute information relating to a single communication or multiple communications serves as a terminal node, from a series of communications with a single communication destination or multiple communication destinations that take place when software is executed, calculates attribute information on a higher node on the basis of attribute information on the terminal node, and classifies the software by specifying the type of the software on the basis of attribute information on the highest node.