公开(公告)号：US20240386110A1

公开(公告)日：2024-11-21

申请号：US18694058

申请日：2021-10-27

Applicant: NEC Corporation

Inventor： Kohei TATARA

IPC: G06F21/56

Abstract: A backdoor detection device according to the present disclosure is equipped with: a normal flow acquisition means that executes, in a test environment, firmware of a device to be monitored, and acquires normal input/output flow information including an input/output flow related to an observed input/output; an operation flow acquisition means that executes the firmware in an actual operating environment, and acquires operation input/output flow information including an input/output flow relating to an observed input/output; a backdoor determination means that determines whether a backdoor is present on the basis of a comparison between the acquired normal input/output flow information and the operation input/output flow information; and an output means that outputs the result of the determination by the backdoor determination means.

公开(公告)号：US20240403425A1

公开(公告)日：2024-12-05

申请号：US18698056

申请日：2021-10-13

Applicant: NEC Corporation

Inventor： Yusuke SHIMADA ,  Nakul GHATE ,  Kohei TATARA

IPC: G06F21/56 ,  G06F8/75 ,  G06F21/57

Abstract: A fraud detection apparatus comprises: a function extraction part that refers to a target function list showing functions to be analyzed and analyzes a program to extract a target function; a structure extraction part that analyzes the program to extract an execution path and a conditional branch; a conditional branch scoring part that refers to a score list showing the probability of meeting the condition of a conditional branch and assigns a score to each of the extracted conditional branches to create a conditional branch score table; a reachability probability calculation part that calculates the probability of reaching the target function from the scores for conditional branches included in the execution path on the basis of the conditional branch score table; and a backdoor determination part that reports an execution path having a low reachability probability as a path with a high probability of being a backdoor execution path.

公开(公告)号：US20240394381A1

公开(公告)日：2024-11-28

申请号：US18693987

申请日：2021-10-27

Applicant: NEC Corporation

Inventor： Kohei TATARA

IPC: G06F21/57

Abstract: A backdoor detection device according to the present disclosure is equipped with: a pattern extraction means that extracts a function flow pattern from the program code of firmware; a frequency information acquisition means that acquires appearance frequency information indicating the appearance frequency of the extracted function flow pattern; a determination means that determines whether a backdoor is included on the basis of the acquired appearance frequency information; and an output means that outputs information indicating the result of the determination by the determination means.