Abstract: A computation procedure change unit (100) changes a computation procedure, each time a computation execution time arrives to execute computation that uses a learning parameter having a value to be adjusted by machine learning, irregularly to a computation procedure which is different from a pre-change computation procedure and with which the same computation result as a computation result obtained by executing computation in accordance with the pre-change computation procedure is obtained. A computation execution unit (101) executes computation that uses the learning parameter, each time the computation execution time arrives, in accordance with the computation procedure that has been changed by the computation procedure change unit (100).

Abstract: Each device of a server device (101) and a client device (102) includes a normal execution unit and a secure execution unit virtually separated. The normal execution unit in each device authenticates validity of activating the secure execution unit with each other. When the validity of activating the secure execution unit is authenticated, a secure communication path is established between the secure execution units in each device. The secure execution unit in the server device (101) decrypts and aggregates model information provided from the client device (102) via the secure communication path. The secure execution unit in the server device (101) encrypts the model information obtained by aggregation, and transmits the model information encrypted to the normal execution unit in the server device (101). The normal execution unit in the server device (101) stores the model information obtained by aggregation in an encrypted state, in a storage unit.

Abstract: A rich execution unit (110) executes an application (111) while executing a rich OS. A secure execution unit (120) executes a target operation, which is an operation based on a learning model, while executing a secure OS. A decryption processing unit (122) decrypts model information from encrypted model information of the learning model when execution of the target operation is requested by the application. An operation execution unit (121) executes the target operation using the model information. A falsification detection unit (123) determines whether the encrypted model information is falsified information. An output control unit (124) passes an execution result of the target operation to the application when it is determined that the encrypted model information is not the falsified information.

Abstract: An object of this invention is to obtain a whitelist generator with which the accuracy of data relating to the specifications of normal communication serving as an automatic generation source can be guaranteed, whereby the accuracy of a generated whitelist can be guaranteed over an entire whitelist generation flow. The whitelist generator is applied to a system formed from a plurality of devices, the plurality of devices being configured to exchange data with each other, in order to generate a whitelist used for whitelisting intrusion detection, and includes a model verification unit that verifies, on the basis of an input model, at least one of whether or not normal communication in the system has been modeled correctly and whether or not the model is logically consistent, and a model conversion unit that converts the verified model into a whitelist.

Abstract: A computation procedure change unit (100) changes a computation procedure, each time a computation execution time arrives to execute computation that uses a learning parameter having a value to be adjusted by machine learning, irregularly to a computation procedure which is different from a pre-change computation procedure and with which the same computation result as a computation result obtained by executing computation in accordance with the pre-change computation procedure is obtained. A computation execution unit (101) executes computation that uses the learning parameter, each time the computation execution time arrives, in accordance with the computation procedure that has been changed by the computation procedure change unit (100).

Abstract: A state detection section (105) detects states of a plurality of controllers (300, 400) included in a communication system (600). An attack determination section (103) selects, from among a plurality of whitelists (110) each of which is associated with a combination of states, a whitelist (110) associated with the combination of the states of the plurality of controllers (300, 400) detected by the state detection section (105). The attack determination section (103) detects an attack on the communication system (600) by using the selected whitelist (110).

Abstract: A learning-and-recognition apparatus (200) includes a learning-and-recognition unit (102) to perform learning-and-recognition processing on input data (101) and output output data and a time control unit (111) to cause a processing time of the learning-and-recognition unit (102) on the input data (101) to be independent of the input data. The time control unit (111) includes an input control unit (112) to perform processing on the input data (101) to change the processing time of the learning-and-recognition unit (102). The input control unit (112) has a data masking unit (201) to apply random noise to the input data.

Abstract: An allowed communication list conversion unit (123) assigns one or more flags to request communication and response communication, between which a correspondence relationship is described in a detection rule, and describes, in an allowed communication list, details of a flag operation specifying a value to be set to the flag and a flag condition for determining whether the value to be set is set in the flag, in association with each other. A determination unit (103) sets the value after determining that communication data on the request communication is normal, determines whether the value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal, and determines that the communication data on the response communication is normal when the value is set, to thereby reset the flag.

Abstract: A state detection section (105) detects states of a plurality of controllers (300, 400) included in a communication system (600). An attack determination section (103) selects, from among a plurality of whitelists (110) each of which is associated with a combination of states, a whitelist (110) associated with the combination of the states of the plurality of controllers (300, 400) detected by the state detection section (105). The attack determination section (103) detects an attack on the communication system (600) by using the selected whitelist (110).

Abstract: An object of this invention is to obtain a whitelist generator with which the accuracy of data relating to the specifications of normal communication serving as an automatic generation source can be guaranteed, whereby the accuracy of a generated whitelist can be guaranteed over an entire whitelist generation flow. The whitelist generator is applied to a system formed from a plurality of devices, the plurality of devices being configured to exchange data with each other, in order to generate a whitelist used for whitelisting intrusion detection, and includes a model verification unit that verifies, on the basis of an input model, at least one of whether or not normal communication in the system has been modeled correctly and whether or not the model is logically consistent, and a model conversion unit that converts the verified model into a whitelist.

Abstract: A state detection section (105) detects states of a plurality of controllers (300, 400) included in a communication system (600). An attack determination section (103) selects, from among a plurality of whitelists (110) each of which is associated with a combination of states, a whitelist (110) associated with the combination of the states of the plurality of controllers (300, 400) detected by the state detection section (105). The attack determination section (103) detects an attack on the communication system (600) by using the selected whitelist (110).

Abstract: In an attack detection device, a white list storage unit correlates and stores, for each system state, a white list defining system information permitted in the system state. A state estimation unit estimates a current system state of a control system on the basis of communication data communicated between a server device and equipment. An attack determination unit acquires the white list corresponding to the current system state from the white list storage unit, and determines whether or not an attack has been detected, on the basis of the acquired white list and the system information in the current system state.

Abstract: A model generation unit (112) generates a state model that indicates a measurement value in each state of a monitoring target, based on a plurality of measurement values obtained by measuring the monitoring target. An integration unit (114) generates a detection rule that indicates communication information in each state of the monitoring target, based on pieces of communication data communicated by the monitoring target in a time period during which the plurality of measurement values are obtained. An attack detection unit (115) determines whether new communication data is attack data, using the state model and the detection rule.

Abstract: An allowed communication list conversion unit (123) assigns one or more flags to request communication and response communication, between which a correspondence relationship is described in a detection rule, and describes, in an allowed communication list, details of a flag operation specifying a value to be set to the flag and a flag condition for determining whether the value to be set is set in the flag, in association with each other. A determination unit (103) sets the value after determining that communication data on the request communication is normal, determines whether the value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal, and determines that the communication data on the response communication is normal when the value is set, to thereby reset the flag.

Abstract: A state management unit (210) identifies a state of an operational system, and determines presence or absence of a state transition of the operational system based on the identified state. In a case where there has been a state transition of the operational system, the state management unit determines, with use of a state transition scenario indicating a transition pattern of state transition, whether the state transition of the operational system matches the transition pattern indicated in the state transition scenario. If the state transition of the operational system does not match the transition pattern, an alert output unit (293) outputs an alert. If the state transition of the operational system matches the transition pattern, a whitelist management unit (220) switches whitelists, and an intrusion detection unit (230) performs whitelist-type intrusion detection.

Abstract: A data determination apparatus of the present invention includes a state transition model storage unit to store a state transition model representing a state transition, a state management unit to hold an operating state of an own apparatus based on the state transition model, a communication permission list storage unit to store, as a communication permission list, communication permitted data whose communications are permitted in respective operating states, a communication unit to obtain communication determination data, and a determination unit to determine whether or not the communication determination data is communication permitted data whose communication has been permitted in a current operating state, using the current operating state and the communication permission list.

Abstract: A data determination apparatus of the present invention includes a state transition model storage unit to store a state transition model representing a state transition, a state management unit to hold an operating state of an own apparatus based on the state transition model, a communication permission list storage unit to store, as a communication permission list, communication permitted data whose communications are permitted in respective operating states, a communication unit to obtain communication determination data, and a determination unit to determine whether or not the communication determination data is communication permitted data whose communication has been permitted in a current operating state, using the current operating state and the communication permission list.