Abstract: Provided is an information processing device which is capable of suppressing a deterioration in accuracy of detecting an anomaly and accuracy of analyzing the anomaly, while suppressing an increase in an amount of data to be stored. The information processing system includes anomaly detection unit that collects event data indicating a predetermined event detected in a process of a device to be monitored, determines whether a predetermined index value related to the event exceeds a preset first threshold, and instructs enhanced monitoring of the device to be monitored and the process related to the event when the index value exceeds the first threshold, and collection instruction unit that determines an additional event being an event to be additionally monitored when the enhanced monitoring is instructed, and instructs the device to be monitored, which is subjected to the enhanced monitoring, to monitor the determined additional event.

Abstract: An information processing apparatus includes: a reach-extent extraction unit configured to extract, with use of a relationship graph representing relationships between a plurality of elements included in a system and location information that indicates, on the relationship graph, a plurality of locations in the system where anomalies have been detected, paths in the relationship graph as being reach extents, the path including a set of the elements that are directly or indirectly related to each of the plurality of locations as a source; and a shared-extent extraction unit configured to extract an influence process of an anomaly by extracting an extent that is shared in at least a prescribed number of paths among paths in the relationship graph that have been extracted as the reach extents.

Abstract: The present invention provides an information processing device that outputs information including the data transmission relationship between elements constituting an information processing system, the information indicating the state of the information processing system. The information processing device includes a graphing means for generating a relationship graph based on an event log indicating the behavior of each of a plurality of processes operating in the system, the relationship graph having the processes as the vertices thereof and having the data transmission relationship between the vertices as the sides thereof; and a graph output means for outputting the generated relationship graph.

Abstract: The present invention provides an information processing device that improves the detectability of system errors. This information processing device includes: a means that generates a state graph based on relationship change information indicating a change in the relationship between a plurality of elements included in a system, the state graph having the elements as the vertices thereof and the relationship between the elements as the sides thereof; a means that generates a normal model having the state graph as a set of conditions to be fulfilled during normal system operation, based on the relationship change information; and a means that detects system errors and outputs error information indicating detected errors, based on the state graph and the normal model.

Abstract: The purpose of the present invention is to provide a technology which assists a verifying party in ascertaining an anomaly in an event of which notification has been made. Provided is an assistance device, comprising: an acquisition unit which acquires as an associated event, from among events which take place among a plurality of elements, and with respect to elements which have been associated with an event which has been detected as an anomalous event, an event other than the anomalous event which has been associated with the elements; and a generating unit which, on the basis of the anomalous event and the associated event, generates a relational graph in which the elements are vertices, the relations among the elements are edges, the anomalous event and the associated event are respectively represented, and the associated event is displayed in a display screen in a different manner from the manner in which the anomalous event is displayed.

Abstract: The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.

Abstract: Provided is, for example, a display control apparatus that generates display information with which an event having occurred in an information processing system can be easily determined. This display control apparatus 101 comprises a display control unit 102 that, on the basis of device information indicating a device detected by a first information processing apparatus in an information processing system and communication information indicating communication executed between a second information processing apparatus in the information processing system and a third information processing apparatus in the information processing system: performs displaying on a display apparatus in a manner such that said device and said first information processing apparatus are associated with one another; and performs displaying on said display apparatus in a manner such that said second information processing apparatus and said third information processing apparatus are associated with one another.

Abstract: Disclosed are an information selection device and the like that make it possible to rapidly acquire information about an event of interest. An information selection device is configured to specify target log information among log information. The log information represents that a process is executed for a processing object in a target system and the target log information represents a processing object that may affect an abnormal process executed in the target system. The information selection device is configured to calculate a frequency of the target log information for each combination of the process with the processing object, calculate an abnormality degree of the target log information based on the calculated frequency and select relevant log information with having the abnormality degree satisfying a condition for determining abnormal log information among the target log information.

Abstract: Provided is, for example, a display control apparatus that generates display information for specifying an event occurred in an information processing system easily.

Abstract: Provided is an information processing device which is capable of suppressing a deterioration in accuracy of detecting an anomaly and accuracy of analyzing the anomaly, while suppressing an increase in an amount of data to be stored. The information processing system includes anomaly detection unit that collects event data indicating a predetermined event detected in a process of a device to be monitored, determines whether a predetermined index value related to the event exceeds a preset first threshold, and instructs enhanced monitoring of the device to be monitored and the process related to the event when the index value exceeds the first threshold, and collection instruction unit that determines an additional event being an event to be additionally monitored when the enhanced monitoring is instructed, and instructs the device to be monitored, which is subjected to the enhanced monitoring, to monitor the determined additional event.

Abstract: Disclosed are a display control device, etc., with which information is displayed according to a display mode having high visibility.

Abstract: Disclosed are a display device, etc. which display information in a display format that provides high visibility. The display device 201 comprises a display unit 202 which displays first nodes, each representing a different communication entity with communication capabilities, or second nodes, each representing a different group of a plurality of communication entities, around a first region, and which shows communications being carried out between first and second nodes, between a plurality of first nodes, or between a plurality of second nodes, in a display format in which the connections between these communicating nodes are indicated within the first region.

Abstract: The purpose of the present invention is to provide a software analysis device which efficiently analyzes a computer environment in which software is capable of running. The software analysis system determines an order of detection devices, generates order information representing the order, and calculate a progression degree of abnormality based on how degree a predetermined order include the order in the order information.

Abstract: Provided is, for example, a display control apparatus that generates display information for specifying an event occurred in an information processing system easily.

Abstract: The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.

Abstract: The present invention provides an information processing system for more appropriately classifying elements that constitute an information processing device or the like. This information processing system is provided with: a means that, on the basis of information indicating the relationship between a plurality of elements that constitute a system, acquires, for first elements to be classified, a set of second elements capable of arriving at the first elements via a relationship of arbitrary numbers; and a means that, on the basis of the set corresponding to the first elements, classifies each of the first elements in any of a plurality of roles.

Abstract: Disclosed are a display control device, etc., with which information is displayed according to a display mode having high visibility.

Abstract: Disclosed are an event estimation device, etc., which are capable of estimating with high precision whether a communication is singular. Provided is an event estimation device (101), comprising: a model creation unit (102) which creates a model which, on the basis of a frequency with which a communication is executed, computes that a degree of singularity which represents the extent to which the communication is singular is high if the frequency is low, and computes that the degree of singularity is low if the frequency is high; and an estimation unit (103) which computes the degree of singularity by applying the model to the frequency relating to a given communication, and if the computed degree of singularity satisfies a standard, estimates that the given communication is singular, and if the computed degree of singularity does not satisfy the standard, estimates that the given communication is not singular.

Abstract: Disclosed are a display device, etc. which display information in a display format that provides high visibility. The display device 201 comprises a display unit 202 which displays first nodes, each representing a different communication entity with communication capabilities, or second nodes, each representing a different group of a plurality of communication entities, around a first region, and which shows communications being carried out between first and second nodes, between a plurality of first nodes, or between a plurality of second nodes, in a display format in which the connections between these communicating nodes are indicated within the first region.

Abstract: The present invention provides an information processing device that improves the detectability of system errors. This information processing device includes: a means that generates a state graph based on relationship change information indicating a change in the relationship between a plurality of elements included in a system, the state graph having the elements as the vertices thereof and the relationship between the elements as the sides thereof; a means that generates a normal model having the state graph as a set of conditions to be fulfilled during normal system operation, based on the relationship change information; and a means that detects system errors and outputs error information indicating detected errors, based on the state graph and the normal model.