公开(公告)号：US20190220380A1

公开(公告)日：2019-07-18

申请号：US16304472

申请日：2017-05-25

Applicant: CHUBU ELECTRIC POWER COMPANY, INC. ,  NEC CORPORATION

Inventor： Motohiro ICHIBA ,  Hideyuki ISHIGAMI ,  Takayoshi ASAKURA ,  Tomoya SOMA ,  Mayumi TAKAGI

IPC: G06F11/30 ,  G06F11/34 ,  G05B23/02

CPC classification number: G06F11/3055 ,  G05B23/02 ,  G05B23/0243 ,  G06F11/30 ,  G06F11/34 ,  G06F11/3447

Abstract: There is provided a system model evaluation system including a system model candidate creation part configured to create a candidate(s) of a system model by changing a pattern of selecting an inter-sensor-value relationship created by using sensor values acquired from sensors arranged in a system to which the system model is directed. This system model evaluation system further includes a system model evaluation part configured to evaluate the candidate(s) of the system model by inputting predetermined evaluation data to the created candidate(s) of the system model.

公开(公告)号：US20210049477A1

公开(公告)日：2021-02-18

申请号：US16963873

申请日：2018-12-20

Applicant: NEC CORPORATION

Inventor： Yoshiaki SAKAE ,  Kazuhiko ISOYAMA ,  Takayoshi ASAKURA

IPC: G06N5/02 ,  G06F9/54 ,  G06F11/30

Abstract: Based on a normal model, it is detected whether or not an event signal of a computer system is anomalous. In parallel with the normal-model-based anomaly detection, it is detected based on a rule whether or not the event signal is anomalous. Then, a final anomaly detection result is generated by performing comprehensive determination based on detection results of the normal-model-based anomaly detection and the rule-based anomaly detection.

公开(公告)号：US20200244688A1

公开(公告)日：2020-07-30

申请号：US16634964

申请日：2018-08-07

Applicant: NEC Corporation

Inventor： Etsuko ICHIHARA ,  Yoshiaki SAKAE ,  Shuichi KARINO ,  Hiroki TAGATO ,  Kazuhiko ISOYAMA ,  Yuji KOBAYASHI ,  Takayoshi ASAKURA

IPC: H04L29/06

Abstract: Disclosed are an information selection device and the like that make it possible to rapidly acquire information about an event of interest. An information selection device is configured to specify target log information among log information. The log information represents that a process is executed for a processing object in a target system and the target log information represents a processing object that may affect an abnormal process executed in the target system. The information selection device is configured to calculate a frequency of the target log information for each combination of the process with the processing object, calculate an abnormality degree of the target log information based on the calculated frequency and select relevant log information with having the abnormality degree satisfying a condition for determining abnormal log information among the target log information.