Event detection system, management terminal and program, and event detection method

• US 20070150955A1
• Filed: 12/21/2006
• Published: 06/28/2007
• Est. Priority Date: 12/27/2005
• Status: Abandoned Application

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Shimonishi, Hideyuki, Murase, Tutomu
• Application Number:
  US11/642,830
• Publication Number:
  US 20070150955A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An analyzing terminal 3 monitors a to-be-monitored characteristic amount. When a change in the characteristic amount is detected, the analyzing terminal 3 notifies the effect that a change in the characteristic amount has been detected to a management terminal 4. The management terminal 4 sums up the number of the analyzing terminal having notified a change in the characteristic amount. And, the management terminal 4 determines whether an event has occurred according to the summed-up value.

Claims

1. An event detection system comprising:

a detection point for detecting a change in a to-be-monitored characteristic amount; and

event detector for, based upon a number of a detection point at which a change in the to-be-monitored characteristic amount has been detected, detecting an event.

2. The event detection system according to claim 1, wherein said event detector, which has a predetermined threshold set, is configured to determine that the event has occurred in a case where the number of the detection point at which a change in the characteristic amount has been detected has exceeded said threshold.

3. The event detection system according to claim 1, wherein said event detector, which has a predetermined threshold set, is configured to determine that the event has occurred in a case where a ratio of the number of the detection point at which a change in the characteristic amount has been detected over the number of all detection points has exceeded said threshold.

4. The event detection system according to claim 1, wherein said event detector comprises:

a weighter for making a weighting for the detection point at which a change in the characteristic amount has been detected; and

event detector for, based upon the number of the point for which a weighting has been made, detecting the event.

5. The event detection system according to claim 4, wherein said weighting is decided responding to an appliance that said detection point monitors.

6. The event detection system according to claim 4, wherein said weighting is decided responding to a reliability degree of said detection point.

7. A management terminal, comprising event detector for, based upon a number of a detection point at which a change in a to-be-monitored characteristic amount has been detected, detecting an event.

8. The management terminal according to claim 7, wherein said event detector, which has a predetermined threshold set, is configured to determine that the event has occurred in a case where the number of the detection point at which a change in the characteristic amount has been detected has exceeded said threshold.

9. The management terminal according to claim 7, wherein said event detector, which has a predetermined threshold set, is configured to determine that the event has occurred in a case where a ratio of the number of the detection point at which a change in the characteristic amount has been detected over the number of all detection points has exceeded said threshold.

10. The management terminal according to claim 7, wherein said event detector comprises:

a weighter for making a weighting for the detection point at which a change in the characteristic amount has been detected; and

event detector for, based upon the number of the point for which a weighting has been made, detecting the event.

11. The management terminal according to claim 10, wherein said weighting is decided responding to a to-be-monitored appliance.

12. The management terminal according to claim 10, wherein said weighting is decided responding to a reliability degree of said detection point.

13. A program of an information processing unit, said program causing said information processing unit to execute an event detection process of, based upon a number of a detection point at which a change in a to-be-monitored characteristic amount has been detected, detecting an event.

14. The program according to claim 13, wherein said event detection process is a process of, in a case where the number of the detection point at which a change in the characteristic amount has been detected has exceeded a predetermined threshold, determining that the event has occurred.

15. The program according to claim 13, wherein said event detection process is a process of, in a case where a ratio of the number of the detection point at which a change in the characteristic amount has been detected over the number of all detection points has exceeded a predetermined threshold, determining that the event has occurred.

16. The program according to claim 13, wherein said event detection process is a process of making a weighting for the detection point at which a change in the characteristic amount has been detected, and detecting the event based upon the number of the point for which a weighting has been made.

17. The program according to claim 16, wherein said weighting is decided responding to a to-be-monitored appliance.

18. The program according to claim 16, wherein said weighting is decided responding to a reliability degree of said detection point.

19. An event detection method, wherein an event is detected based upon a number of a detection point at which a change in a to-be-monitored characteristic amount has been detected.

20. The event detection method according to claim 19, wherein it is determined that the event has occurred in a case where the number of the detection point at which a change in the characteristic amount has been detected has exceeded a predetermined threshold.

21. The event detection method according to claim 19, wherein it is determined that the event has occurred in a case where a ratio of the number of the detection point at which a change in the characteristic amount has been detected over the number of all detection points has exceeded a predetermined threshold.

22. The event detection method according to claim 19, wherein a weighting is made for the detection point at which a change in the characteristic amount has been detected to detect the event based upon the number of the point for which a weighting has been made.

23. The event detection method according to claim 22, wherein said weighting is decided responding to an appliance that the detection point monitors.

24. The event detection method according to claim 22, wherein said weighting is decided responding to a reliability degree of the detection point.