公开(公告)号：JP2004128733A

公开(公告)日：2004-04-22

申请号：JP2002287758

申请日：2002-09-30

Applicant: Internatl Business Mach Corp ,  インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Maschines Corporation

Inventor： ETO HIROAKI ,  YODA KUNIKAZU

IPC: G06F13/00 ,  H04L12/70 ,  H04L29/06 ,  H04L12/56

CPC classification number: H04L63/1408 ,  H04L63/1441

Abstract: PROBLEM TO BE SOLVED: To monitor communications via a host computer placed under the management of a security means such as a fire-wall and a filter function of a router. SOLUTION: A packet input means which is connected to a prescribed point of a network by a network interface and inputs a communication packet flowing through the point, and a matching means which executes matching of two packet streams respectively constituted of inputted communication packets in real time whenever the communication packet is inputted, are provided. And, when the two packet streams are very similar to each other, it is assumed that it is highly likely to be intruded and attacked, and it is notified. COPYRIGHT: (C)2004,JPO

公开(公告)号：JP2001216161A

公开(公告)日：2001-08-10

申请号：JP2000028358

申请日：2000-02-04

Applicant: IBM

Inventor： ETO HIROAKI ,  YODA KUNIKAZU

IPC: G06F9/42 ,  G06F21/22

Abstract: PROBLEM TO BE SOLVED: To prevent stack smashing attack due to buffer overflow on a stack. SOLUTION: This memory device is used by a computer system. It is provided with an area to store a return address 230 to a call origin of a function under execution, an area to store a previous frame pointer 22 to the call origin of the function under execution and an area to be located in the rear of the area to store the return address 230 and the area to store the previous frame pointer 220 and to store local variables as memory patterns of this memory device after invoking the function when this computer system executes programs. The area to store the local variables stores a guard variable 212 as an object to confirm whether or not it is destroyed in a return processing of the function under execution before this arrangement 211 when the arrangement 211 is stored in the area to store the local variables.

公开(公告)号：JP2005216066A

公开(公告)日：2005-08-11

申请号：JP2004023081

申请日：2004-01-30

Applicant: Internatl Business Mach Corp ,  インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Maschines Corporation

Inventor： IDE TAKESHI ,  YODA KUNIKAZU ,  KAJIMA HISATSUGU ,  ETO HIROAKI ,  HIRAIDE RYO

IPC: G06F11/30 ,  G06F11/00 ,  G06F11/34 ,  G06F13/00 ,  G06F15/00

CPC classification number: G06F11/0709 ,  G06F11/0751 ,  H04L67/02 ,  H04L69/40

Abstract: PROBLEM TO BE SOLVED: To detect abnormity online by monitoring a system wherein a plurality of computers in a web system or the like are operating in correlation with each other. SOLUTION: Each of the plurality of computers collects the transactions of services for another computer and calculates a correlation matrix between nodes in the system in accordance with the transactions and obtains a feature vector showing the activity balance of nodes from the correlation matrix. The feature vector is monitored by using a probability model to detect transition to an abnormal state. COPYRIGHT: (C)2005,JPO&NCIPI

Abstract translation: 要解决的问题：通过监视web系统等中的多个计算机彼此相关操作的系统来在线检测异常。 多个计算机中的每个计算机收集另一计算机的服务事务，并根据事务计算系统中的节点之间的相关矩阵，并从相关矩阵中获得显示节点活动平衡的特征向量。 通过使用概率模型来监测特征向量以检测到异常状态的转变。 版权所有（C）2005，JPO＆NCIPI

公开(公告)号：JP2004315949A

公开(公告)日：2004-11-11

申请号：JP2003115246

申请日：2003-04-21

Applicant: Internatl Business Mach Corp ,  インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Maschines Corporation

Inventor： YODA KUNIKAZU ,  OKANO HIROYUKI

IPC: C21D11/00 ,  G05B5/01 ,  G05B13/02 ,  G05D23/19

CPC classification number: G05B5/01 ,  G05D23/1917

Abstract: PROBLEM TO BE SOLVED: To calculate data in a continuous annealing line of ironworks, in order to know whether there is a possibility of realizing such a temperature control as to satisfy the condition of upper limit LH_i and lower limit LL_i of the control temperature for each annealing concerning an iron section i to be annealed, though being restricted by limiting values U and D about the ascending and descending speed of a control temperature, without using a dynamic programming requiring an enormous amount of data.
SOLUTION: This calculating method includes putting number 1, 2, to n from the front in a moving direction in turn, to the section of iron to be annealed in a belt-shaped iron 12 to be annealed which is an object to be calculated. T_i is a necessary time for the iron section i to be annealed to pass through a predetermined point in which the temperature of the section is controlled. LH_1= LL_1= b is data. The method calculates X_i=[IL_i-D*T_i, IH _i + OR*T_i]. In the case of X_i and L_i≠ϕ, Y_i is equalized to X_i and L_i. In the case of X_i and L_i=ϕ, Y_i is equalized to X_i. The method calculates Y_i from i=1 to i=n in an ascending order.
COPYRIGHT: (C)2005,JPO&NCIPI

公开(公告)号：JP2001217834A

公开(公告)日：2001-08-10

申请号：JP2000025594

申请日：2000-02-02

Applicant: IBM

Inventor： YODA KUNIKAZU ,  ETO HIROAKI

IPC: G06F13/00 ,  H04L12/26 ,  H04L29/06 ,  H04L12/24 ,  H04L12/56

Abstract: PROBLEM TO BE SOLVED: To obtain a method for tracking an access chain which does not depend on the data contents of a packet and its system. SOLUTION: The log data of the packet coming in and going out a network are stored in a log box. In such a case, the data size and detection time of the packet are recorded. When illegal access is made to a target computer, an illegal access chain is tracked on the basis of the log information. The access chain tracking is performed as follows. The change of the packet data size at the time in a 1st connection and the change of the packet data size at the time in a 2nd connection are calculated from the log data. The shapes of graphs formed by these sequences are compared and when the shapes are similar, the connections are decided as being included in the same chain.

公开(公告)号：JPH10240747A

公开(公告)日：1998-09-11

申请号：JP3460597

申请日：1997-02-19

Applicant: IBM

Inventor： YODA KUNIKAZU ,  FUKUDA TSUYOSHI ,  TOKUYAMA TAKESHI ,  MORISHITA SHINICHI

IPC: G06F17/18 ,  G06F9/44 ,  G06F17/30 ,  G06F19/00 ,  G06N5/04 ,  G06Q40/00 ,  G06Q40/02

Abstract: PROBLEM TO BE SOLVED: To make it easy to find a connection rule between data by composing a plane of two numeric attributes that an analyzed body has and cutting an orthogonal projection area between true and false attributes under specific conditions. SOLUTION: A database having data including two kinds of numeric attribute and one kind of true/false attribute has two axes corresponding to two kinds of numeric attribute and stores the number v(i, j) of data belonging to respective pixels (i row, j column) of a plane divided into N×N pixels and the number v(i, j) of data whose true/false attributes are true. Then a specific condition θis inputted to cut an orthogonal projection area S of pixels, maximizing an equation I, out of a plane. Thus, the area in the orthogonal projection shape is cut out to make it easy for people to grasp the connection rule. Lastly, data included in the cut orthogonal projection area S are outputted.