Information processing apparatus, control method, and program

Patent metadata

Field	Value
Publication number	US-2022019660-A1
Application number	US-201817294167-A
Country	US
Kind code	A1
Filing date	Nov 16, 2018
Priority date	Nov 16, 2018
Publication date	Jan 20, 2022
Grant date	—

Abstract

An information processing apparatus (2000) acquires an event graph (10) to be output and determines a subgraph satisfying a predetermined reference from the acquired event graph (10) to be output. In the event graph (10), an activity content in an event related to an activity of a program is represented as an edge (14), and each of a subject and an object of the event is represented as a node (12). The information processing apparatus (2000) outputs the event graph (10) with an output mode of the determined subgraph as a first mode and with an output mode of another portion as a mode other than the first mode. The first mode is a mode in which at least one of the number of nodes (12) and the number of edges (14) is reduced than the number included in the determined graph.

First claim

What is claimed is:

1 . An information processing apparatus comprising:
a determination unit that acquires an event graph to be output and determines a subgraph satisfying a predetermined reference from the acquired event graph to be output; and an output unit that outputs the event graph, with an output mode of the determined subgraph as a first mode and an output mode of another portion as a mode other than the first mode, wherein the event graph represents an activity content in an event related to an activity of a program as an edge and represents each of a subject and an object of the event as a node, and the first mode is a mode in which at least one of the number of nodes and the number of edges is reduced than the number of nodes and the number of edges included in the determined subgraph.

2 . The information processing apparatus according to claim 1 , wherein
the predetermined reference is a reference satisfied by a subgraph representing an event sequence that occurs in a normal state.

3 . The information processing apparatus according to claim 2 , wherein
the predetermined reference is a reference indicating that one process accesses a plurality of files having the same extension.

4 . The information processing apparatus according to claim 2 , wherein
the predetermined reference is a reference indicating communication with one process performed by a plurality of apparatuses belonging to the same subnet.

5 . The information processing apparatus according to claim 2 , wherein
the predetermined reference is a reference indicating that one process accesses a plurality of files or directories satisfying a second predetermined reference.

6 . The information processing apparatus according to claim 5 , wherein
the second predetermined reference is a reference indicating existing under a predetermined directory, or a reference indicating being shown in a predetermined list.

7 . The information processing apparatus according to claim 1 , wherein
the determination unit acquires an event graph representing an event sequence that includes the node representing the subject or the object of the event that is specified by an input operation.

8 . A control method executed by a computer, the method comprising:
acquiring an event graph to be output and determining a subgraph satisfying a predetermined reference from the acquired event graph to be output; and outputting the event graph, with an output mode of the determined subgraph as a first mode and an output mode of another portion as a mode other than the first mode, wherein the event graph represents an activity content in an event related to an activity of a program as an edge and represents each of a subject and an object of the event as a node, and the first mode is a mode in which at least one of the number of nodes and the number of edges is reduced than the number of nodes and the number of edges included in the determined subgraph.

9 . The control method according to claim 8 , wherein
the predetermined reference is a reference satisfied by a subgraph representing an event sequence that occurs in a normal state.

10 . The control method according to claim 9 , wherein
the predetermined reference is a reference indicating that one process accesses a plurality of files having the same extension.

11 . The control method according to claim 9 , wherein
the predetermined reference is a reference indicating communication with one process performed by a plurality of apparatuses belonging to the same subnet.

12 . The control method according to claim 9 , wherein
the predetermined reference is a reference indicating that one process accesses a plurality of files or directories satisfying a second predetermined reference.

13 . The control method according to claim 12 , wherein
the second predetermined reference is a reference indicating existing under a predetermined directory, or a reference indicating being shown in a predetermined list.

14 . The control method according to claim 8 , wherein
in the determining, an event graph representing an event sequence that includes the node representing the subject or the object of the event that is specified by an input operation, is acquired.

15 . A non-transitory computer-readable storage medium storing a program that causes a computer to execute the control method according to claim 8 .

Assignees

• Nec Corp

Inventors

• Ichihara Etsuko
• Sakae Yoshiaki
• Isoyama Kazuhiko
• Nishioka Jun

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F11/32

  with visual {or acoustical} indication of the functioning of the machine · CPC title