Patents by Inventor Yoshiaki SAKAE

Yoshiaki SAKAE has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20220366035
    Abstract: An execution control system (2000) determines whether to permit execution of a target application (30). The determination includes first determination and second determination. The second determination is performed when the first determination cannot determine whether to permit the execution of the target application (30). The execution control system (2000) executes the target application (30) in a protected environment after the first determination is finished and while the second determination is performed.
    Type: Application
    Filed: June 26, 2019
    Publication date: November 17, 2022
    Applicant: NEC Corporation
    Inventors: Yoshiaki SAKAE, Kazuhiko ISOYAMA, Takashi KONASHI, Jun NISHIOKA
  • Patent number: 11449405
    Abstract: An information processing apparatus generates a graph that represents an action of a program. On the graph, an edge represents action contents of a process in an event. Further, two nodes connected by the edge respectively represent a subject and an object of the event. The information processing apparatus outputs the generated graph. Further, the information processing apparatus also alters the generated graph. When an index value of an event satisfies a first predetermined condition which index value is based on the number of occurrences or the frequency of occurrences of the event, the information processing apparatus alters the graph with respect to an edge representing the event.
    Type: Grant
    Filed: March 28, 2018
    Date of Patent: September 20, 2022
    Assignee: NEC CORPORATION
    Inventors: Etsuko Ichihara, Yoshiaki Sakae, Kazuhiko Isoyama, Jun Nishioka
  • Publication number: 20220284107
    Abstract: A policy evaluation apparatus (2000) acquires, with respect to each of a plurality of control groups (10) including an evaluation target group, control policies (20). Each of the control policy (20) indicates execution permission/non-permission of an application. Further, the policy evaluation apparatus (2000) compares an evaluation target policy being the control policy (20) of the evaluation target group with other plurality of control policies (20), and generates evaluation information (30) based on the comparison result.
    Type: Application
    Filed: August 7, 2019
    Publication date: September 8, 2022
    Applicant: NEC Corporation
    Inventors: Jun NISHIOKA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Takashi KONASHI
  • Patent number: 11372839
    Abstract: The purpose of the present invention is to provide a technology which assists a verifying party in ascertaining an anomaly in an event of which notification has been made. Provided is an assistance device, comprising: an acquisition unit which acquires as an associated event, from among events which take place among a plurality of elements, and with respect to elements which have been associated with an event which has been detected as an anomalous event, an event other than the anomalous event which has been associated with the elements; and a generating unit which, on the basis of the anomalous event and the associated event, generates a relational graph in which the elements are vertices, the relations among the elements are edges, the anomalous event and the associated event are respectively represented, and the associated event is displayed in a display screen in a different manner from the manner in which the anomalous event is displayed.
    Type: Grant
    Filed: December 1, 2016
    Date of Patent: June 28, 2022
    Assignee: NEC CORPORATION
    Inventors: Junpei Kamimura, Koji Kida, Kazuhiko Isoyama, Yuji Kobayashi, Hiroki Tagato, Etsuko Ichihara, Yoshiaki Sakae
  • Publication number: 20220156371
    Abstract: A warning apparatus (2000) acquires first detected event information (10) representing, at a first abstraction level, an event set being a set of events having occurred in a target system. The warning apparatus (2000) generates second detected event information (20) from the first detected event information (10). The second detected event information (20) represents, at a second abstraction level, the event set represented by the first detected event information (10). The warning apparatus (2000) determines, from among a plurality of pieces of threat information (30) each representing a threat activity, the threat information (30) having a high degree of relevance to at least either of the first detected event information (10) and the second detected event information (20).
    Type: Application
    Filed: March 25, 2019
    Publication date: May 19, 2022
    Applicant: NEC Corporation
    Inventors: Jun NISHIOKA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Etsuko ICHUHARA
  • Patent number: 11250029
    Abstract: The present invention provides an information processing system for more appropriately classifying elements that constitute an information processing device or the like. This information processing system is provided with: a means that, on the basis of information indicating the relationship between a plurality of elements that constitute a system, acquires, for first elements to be classified, a set of second elements capable of arriving at the first elements via a relationship of arbitrary numbers; and a means that, on the basis of the set corresponding to the first elements, classifies each of the first elements in any of a plurality of roles.
    Type: Grant
    Filed: October 28, 2015
    Date of Patent: February 15, 2022
    Assignee: NEC CORPORATION
    Inventors: Takashi Nomura, Koji Kida, Kazuhiko Isoyama, Junpei Kamimura, Yoshiaki Sakae, Yuji Kobayashi, Etsuko Ichihara
  • Publication number: 20220035914
    Abstract: An information processing apparatus (2000) compares a name of a determination target file with a name of one or more normal files. The information processing apparatus (2000) outputs information related to the determination target file, when a name of the determination target file does not coincide with a name of any of the normal files, and a degree of reliability of the determination target file is equal to or less than a threshold value. A degree of reliability of the determination target file is calculated, based on a degree of similarity between a name of the determination target file and a name of each of the normal files.
    Type: Application
    Filed: September 26, 2018
    Publication date: February 3, 2022
    Applicant: NEC Corporation
    Inventors: Kazuhiko ISOYAMA, Yoshiaki SAKAE, Jun NISHIOKA, Etsuko ICHIHARA
  • Publication number: 20220038472
    Abstract: An information processing apparatus (2000) extracts, from a communication history (20) representing a history of network communication performed by each of a plurality of mobile terminals (10), a communication history (20) indicating communication related to a similar attack. Herein, the communication history (20) includes positional information about the mobile terminal (10). The information processing apparatus (2000) generates attack information related to an attack on the mobile terminal (10) by using positional information indicated by each of the extracted communication histories (20), and outputs the generated attack information.
    Type: Application
    Filed: September 26, 2018
    Publication date: February 3, 2022
    Applicant: NEC corporation
    Inventors: Jun NISHIOKA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Etsuko ICHIHARA
  • Publication number: 20220035906
    Abstract: An information processing apparatus (2000) acquires an event graph (10) to be output. In the event graph (10), an activity content in an event related to an activity of a program is represented as an edge, and each of a subject and an object of the event is represented as a node. By using score information, the information processing apparatus (2000) determines a subgraph that matches an event graph (10) having a score equal to or higher than a threshold value from the event graphs (10) to be output. The score information associates each of a plurality of event graphs (10) with a score based on the number of occurrences of an event sequence represented by the event graph (10). The information processing apparatus (2000) outputs the event graph (10) to be output in a mode in which the determined subgraph and the other portion can be discriminated from each other.
    Type: Application
    Filed: November 12, 2018
    Publication date: February 3, 2022
    Applicant: NEC Corporation
    Inventors: Etsuko ICHIHARA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Jun NISHIOKA
  • Publication number: 20220019660
    Abstract: An information processing apparatus (2000) acquires an event graph (10) to be output and determines a subgraph satisfying a predetermined reference from the acquired event graph (10) to be output. In the event graph (10), an activity content in an event related to an activity of a program is represented as an edge (14), and each of a subject and an object of the event is represented as a node (12). The information processing apparatus (2000) outputs the event graph (10) with an output mode of the determined subgraph as a first mode and with an output mode of another portion as a mode other than the first mode. The first mode is a mode in which at least one of the number of nodes (12) and the number of edges (14) is reduced than the number included in the determined graph.
    Type: Application
    Filed: November 16, 2018
    Publication date: January 20, 2022
    Applicant: NEC Corporation
    Inventors: Etsuko ICHIHARA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Jun NISHIOKA
  • Publication number: 20220012345
    Abstract: A history output apparatus (2000) acquires an abnormal event history (10) being information representing an abnormal event occurring in a target system (100), and determines a kind of the abnormal event represented by the abnormal event history (10). When a kind of the determined abnormal event is a first kind, the history output apparatus (2000) determines a terminal (110) in which the abnormal event occurs, as an output target terminal. Further, the history output apparatus (2000) also determines another terminal (110) performing communication with the terminal (110) in which the abnormal event occurs at or before a point when the abnormal event occurs, as an output target terminal. When the abnormal event represented by the acquired abnormal event history (10) is an abnormal event occurring in the output target terminal, the history output apparatus (2000) outputs information relating to the abnormal event.
    Type: Application
    Filed: February 20, 2019
    Publication date: January 13, 2022
    Applicant: NEC Corporation
    Inventors: Kazuhiko ISOYAMA, Yoshiaki SAKAE, Jun NISHIOKA, Etsuko ISHIHARA
  • Publication number: 20210397498
    Abstract: An information processing apparatus 2000 executes analysis for an event history set (10). The event history set (10) is a set of a plurality of event histories (12). The event history (12) is information relating to an event generated in a target computer system. The information processing apparatus 2000 selects, based on a result of the analysis, an event history (12) to be excluded from deletion targets. The information processing apparatus (2000) deletes, from the event history set (10), an event history (12) other than the event history (12) excluded from the deletion targets.
    Type: Application
    Filed: September 26, 2018
    Publication date: December 23, 2021
    Applicant: NEC corporation
    Inventors: Yoshiaki SAKAE, Kazuhiko lSOYAMA, Jun NISHOKA, Etsuko ICHIHARA
  • Publication number: 20210357274
    Abstract: A first information processing apparatus (2000) determines an alternative representation (20) of an event sequence represented by a plurality of event histories (12), by use of dictionary data (30). The first information processing apparatus (2000) outputs information including the determined alternative representation (20). The dictionary data (30) indicate an event sequence and an alternative representation (20) relating to the event sequence in association with each other.
    Type: Application
    Filed: September 28, 2018
    Publication date: November 18, 2021
    Applicant: NEC Corporation
    Inventors: Yoshiaki SAKAE, Kazuhiko ISOYAMA, Jun NISHIOKA, Etsuko ICHIHARA
  • Publication number: 20210342396
    Abstract: To enable a user to easily recognize temporal order of elements included in a retrieval sentence, a retrieval sentence utilization device 10 includes: a retrieval sentence division unit 11 for dividing a retrieval sentence into a plurality of retrieval contents each of which includes an event; and a directed graph generation unit 12 for generating, from each of the retrieval contents, a subtree in which the event is an edge and a source of the event and an object of the event are nodes, and integrating a plurality of subtrees generated from the retrieval contents to generate a directed graph, wherein the directed graph generation unit 12 places the plurality of subtrees in the directed graph according to occurrence order of events corresponding to the plurality of subtrees.
    Type: Application
    Filed: March 14, 2018
    Publication date: November 4, 2021
    Applicant: NEC Corporation
    Inventors: Jun NISHIOKA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Etsuko ICHIHARA, Kosuke YOSHIDA
  • Publication number: 20210133068
    Abstract: Provided is an information processing device which is capable of suppressing a deterioration in accuracy of detecting an anomaly and accuracy of analyzing the anomaly, while suppressing an increase in an amount of data to be stored. The information processing system includes anomaly detection unit that collects event data indicating a predetermined event detected in a process of a device to be monitored, determines whether a predetermined index value related to the event exceeds a preset first threshold, and instructs enhanced monitoring of the device to be monitored and the process related to the event when the index value exceeds the first threshold, and collection instruction unit that determines an additional event being an event to be additionally monitored when the enhanced monitoring is instructed, and instructs the device to be monitored, which is subjected to the enhanced monitoring, to monitor the determined additional event.
    Type: Application
    Filed: January 11, 2021
    Publication date: May 6, 2021
    Applicant: NEC CORPORATION
    Inventors: Shuichi KARINO, Kazuhiko ISOYAMA, Yuji KOBAYASHI, Yoshiaki SAKAE, Hiroki TAGATO, Masato YASUDA
  • Publication number: 20210109801
    Abstract: An anomaly assessment device includes: a storage storing a correspondence relation between a type of a device, and a transition state candidate group in a stable state of the device of the type; at least one memory storing instructions; and at least one processor configured to execute the instructions to: acquire event information of a monitoring target device; identify a transition state associated with the event information acquired of the monitoring target device; and assesse normality/anomaly of the monitoring target device, based on the transition state candidate group associated with a type of the monitoring target device in the stored correspondence relation, and the identified transition state.
    Type: Application
    Filed: November 17, 2017
    Publication date: April 15, 2021
    Applicant: NEC Corporation
    Inventors: Masato YASUDA, Yoshiaki SAKAE, Hiroki TAGATO, Shuichi KARINO, Kazuhiko ISOYAMA, Yuji KOBAYASHI
  • Patent number: 10949318
    Abstract: Provided is, for example, a display control apparatus that generates display information with which an event having occurred in an information processing system can be easily determined. This display control apparatus 101 comprises a display control unit 102 that, on the basis of device information indicating a device detected by a first information processing apparatus in an information processing system and communication information indicating communication executed between a second information processing apparatus in the information processing system and a third information processing apparatus in the information processing system: performs displaying on a display apparatus in a manner such that said device and said first information processing apparatus are associated with one another; and performs displaying on said display apparatus in a manner such that said second information processing apparatus and said third information processing apparatus are associated with one another.
    Type: Grant
    Filed: December 19, 2016
    Date of Patent: March 16, 2021
    Assignee: NEC CORPORATION
    Inventors: Etsuko Ichihara, Koji Kida, Yoshiaki Sakae, Kazuhiko Isoyama, Junpei Kamimura, Takashi Nomura, Yuji Kobayashi
  • Publication number: 20210049477
    Abstract: Based on a normal model, it is detected whether or not an event signal of a computer system is anomalous. In parallel with the normal-model-based anomaly detection, it is detected based on a rule whether or not the event signal is anomalous. Then, a final anomaly detection result is generated by performing comprehensive determination based on detection results of the normal-model-based anomaly detection and the rule-based anomaly detection.
    Type: Application
    Filed: December 20, 2018
    Publication date: February 18, 2021
    Applicant: NEC CORPORATION
    Inventors: Yoshiaki SAKAE, Kazuhiko ISOYAMA, Takayoshi ASAKURA
  • Publication number: 20210042412
    Abstract: An information processing apparatus (2000) classifies each event that occurred in a target apparatus to be determined (10) either as an event (event of a first class) that also occurs in a standard apparatus (20) or as an event (event of a second class) that does not occur in the standard apparatus (20). Herein, a first model used for a determination with respect to an event that also occurs in the standard apparatus (20) and a second model used for a determination with respect to an event that does not occur in the standard apparatus (20) are used as models for determining whether an event that occurs in a target apparatus to be determined (10) is a target for warning. The information processing apparatus (2000) performs learning of the first model using an event of the first class. Further, the information processing apparatus (2000) performs learning of the second model using an event of the second class.
    Type: Application
    Filed: March 1, 2018
    Publication date: February 11, 2021
    Applicant: NEC CORPORATION
    Inventors: Kazuhiko ISOYAMA, Yoshiaki SAKAE, Jun NISHIOKA, Etsuko ICHIHARA, Kosuke YOSHIDA
  • Publication number: 20210034488
    Abstract: An information processing apparatus generates a graph that represents an action of a program. On the graph, an edge represents action contents of a process in an event. Further, two nodes connected by the edge respectively represent a subject and an object of the event. The information processing apparatus outputs the generated graph. Further, the information processing apparatus also alters the generated graph. When an index value of an event satisfies a first predetermined condition which index value is based on the number of occurrences or the frequency of occurrences of the event, the information processing apparatus alters the graph with respect to an edge representing the event.
    Type: Application
    Filed: March 28, 2018
    Publication date: February 4, 2021
    Applicant: NEC CORPORATION
    Inventors: Etsuko ICHIHARA, Yoshiaki SAKAE, Kazuhiko ISOYAMA, Jun NISHIOKA