Abstract: An estimation device includes processing circuitry configured to extract a fixed-length feature amount from a payload of communication data, calculate a similarity between feature amounts of abnormal communication data, and determine that events are of a same type when the calculated similarity is greater than a predetermined threshold.

Abstract: A displacement measurement device includes: an irradiation unit that irradiates a measurement object with coherent light; a luminance-change coordinate point detection unit that detects a luminance-change coordinate point where a luminance change has occurred, based on light reflected from the measurement object, and outputs data related to the luminance-change coordinate point; and circuitry that calculates an amount of displacement of the measurement object, based on the data related to the luminance-change coordinate point, by performing computations of a first numerical sequence and a second numerical sequence. The first numerical sequence includes a set of first elements each representing a location of the luminance-change coordinate point extracted from the data. The second numerical-sequence includes a set of second elements each representing a location of the luminance-change coordinate point extracted from the data.

Abstract: An estimation apparatus includes processing circuitry configured to extract a predetermined number of similar normal pieces of packet data with a relatively high similarity to abnormal packet data from among a plurality of normal pieces of packet data based on a natural language processing model, and extract same-length packet data with the same packet length as the abnormal packet data from the similar normal packet data extracted, and compare the abnormal packet data with the same-length packet data for each byte to estimate an abnormal byte location.

Abstract: A detection system includes a node and a verification server, wherein the node includes first processing circuitry configured to generate a plurality of random values based on a seed received from the verification server, and generate a response based on information on an area of a first storage content specified by the plurality of generated random values, and transmit the generated response to the verification server, and the verification server includes second processing circuitry configured to generate a plurality of random values based on the seed, generate a verification response based on information on an area of a second storage content specified by the plurality of generated random values, determine whether the response received from the node matches the verification response, and output a determination result.

Abstract: A detection system includes two or more nodes and a base station that holds information on each of the nodes, wherein the base station includes first processing circuitry configured to search for a circuit passing through all nodes in a network only once, sequentially calculate as many hash values as a number of nodes in the network, and notify each node of an order in the circuit, a hash value according to the order among the calculated hash values, and a node in a subsequent stage in the circuit, and each of the nodes includes second processing circuitry configured to send a hash value notification of which is provided and a challenge to a node in a subsequent stage according to the order notification of which is provided, and verify whether or not the sent hash value matches a value calculated from the hash value notification of which is provided.

Abstract: An abnormality detection device includes processing circuitry configured to input a normal packet to a Bidirectional Encoder Representations from Transformers (BERT) model learned using the normal packet, and acquire a size of Attention for each byte portion when encoding of the normal packet is performed, sample an important byte portion of the normal packet based on the size of the Attention of each byte portion of the normal packet acquired, and rewrite the sampled important byte portion to a random byte to generate a pseudo-abnormal packet, and determine a threshold value of an abnormality degree for detecting an abnormal packet based on the abnormality degree of the generated pseudo-abnormal packet group and normal packet group.

Abstract: A detection device includes: an encoding unit that converts one packet to be detected into one fixed-length vector by using natural language processing technology; and a detection unit that detects presence or absence of an abnormality in the packet to be detected based on the fixed-length vector converted by the encoding unit using a detection model.

Abstract: A learning device includes processing circuitry configured to calculate a degree of deviation between a first output obtained by inputting first training data to a learned first model and a second output obtained by inputting second training data created by giving noise to the first training data to a second model, and a degree of deviation between an intermediate representation of the first model generated in a process of obtaining the first output and an intermediate representation of the second model generated in a process of obtaining the second output, and update a parameter of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced.

Abstract: A detection device includes processing circuitry configured to acquire data to be detected and normal reference data, calculate a Learned Perceptual Image Patch Similarity (LPIPS) distance between the acquired data and the reference data, and classify the acquired data into either a Clean Sample or an Adversarial Example by using the calculated LPIPS distance.

Abstract: A tampering detection device includes tampering detection circuitry configured to acquire an access frequency of a monitoring target file, calculate a number of times of scanning in a scan pattern for each monitoring target file on a basis of the access frequency acquired, and determine the scan pattern on a basis of the number of times of scanning calculated.

Abstract: A detection device includes a feature value database configured to store a packet feature value, a label assigned to each packet feature value, and a threshold used for determination in advance. The detection device includes a memory and a processor coupled to the memory. The processor is configured to perform operations including: converting a target packet into a feature value using a first natural language processing model that has been trained using normal communication packets as learning data; assigning a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model and the data stored in the feature value database; and determining whether the target packet has an anomaly based on the assigned label.

Abstract: A device acquires a file path of determination target equipment that is a determination target of file integrity, generates a concealment path for digesting the acquired file path for each file path, generates a concealment determination reference in which the generated concealment path and a hash value obtained by digesting file data stored in the determination target equipment are listed in association with each other, generates a concealment list by associating the file path stored in the determination target equipment with the generated concealment path, generates a determination reference by associating the file path with a hash value obtained by digesting the file data using the generated concealment determination reference and the generated concealment list, and calculates a hash value for each piece of the file data in the determination target equipment and determines file integrity based on the hash value and a hash value included in the determination reference.

Abstract: The estimation apparatus includes: a conversion unit that converts abnormal packet data into abnormal vector data using a model that converts packet data into vector data in which each byte of the packet data is associated with each vector representing a characteristic of a value of each byte; an extraction unit that extracts normal vector data having a relatively high similarity to the abnormal vector data from among a plurality of pieces of normal vector data obtained by converting a plurality of pieces of normal packet data using the model; and an estimation unit that estimates an abnormal byte in the abnormal packet data from a similarity between a vector corresponding to each byte of the abnormal vector data and a vector corresponding to each byte of the extracted normal vector data.

Abstract: An information processing apparatus includes a processor configured to acquire, from a read image, a predetermined item, and a value corresponding to the item, the read image being obtained by reading a document and being subjected, prior to acquisition of the item and the value, to preprocessing and character recognition. Further, the processor is configured to, in response to not successfully acquiring at least one of the item and the value, change a setting on the preprocessing or a setting on the character recognition in accordance with the acquisition or non-acquisition state of the item and the value, and then perform the preprocessing or the character recognition. In response to not successfully acquiring at least one of the item and the value, the processor is further configured to identify where the item and the value are located.

Abstract: A tampering detection device includes tampering detection circuitry configured to acquire an access pattern of a monitoring target file, extract a time-series pattern of access for each monitoring target file from the access pattern acquired, and determine a scan pattern on a basis of the time-series pattern of access extracted.

Abstract: In the vehicle body structure including a body frame and a stabilizer which is supported by the body frame and connected to left and right front suspension arms, the body frame has an upper frame and a cross member connected to the upper frame, and the upper frame and the cross member are located upward of the front suspension arms. The cross member is connected to an air guide panel for redirecting ambient air flowing from the front of the vehicle body, and the air guide panel is arranged in a position overlapping the stabilizer in a vertical direction.

Abstract: An estimation device includes processing circuitry configured to generate a feature quantity by performing invertible transformation on a payload of a packet character by character with respect to each packet determined to be abnormal or normal by an abnormality detector, and give a determination result as to whether a packet is abnormal or normal to the generated feature quantity, learn a model that classifies whether the packet is abnormal or normal by machine learning using the feature quantity of the payload of the packet and the determination result as to whether the packet is abnormal or normal as teacher data, extract a number of dimensions of the feature quantity in which a contribution degree to classification is equal to or greater than a predetermined value in the learned model, and estimate a cause part of abnormality in the payload of the packet determined to be abnormal.

Abstract: A detecting device (10) acquires information related to communication by an IoT device. The detecting device (10) inputs data representing a feature of the information related to the communication to a generative model which generates output data on the basis of a latent variable which is a random variable according to a mixed Gaussian distribution and input data, and calculates the output data. The detecting device (10) calculates an anomaly score on the basis of the output data and detects an anomaly in the IoT device when the anomaly score exceeds a threshold value.

Abstract: A determination unit determines necessity of relearning of an initial learning model based on at least one of information regarding the initial learning model generated by learning initial learning data known to be normal, information regarding over-detection data over-detected by an abnormality detection system that uses the initial learning model, and information regarding an over-detection model generated based on the over-detection data. A notification unit notifies of determination result by determination unit.

Abstract: A detection device includes: an encoding unit that converts one packet to be detected into one fixed-length vector by using natural language processing technology; and a detection unit that detects presence or absence of an abnormality in the packet to be detected based on the fixed-length vector converted by the encoding unit using a detection model.