Analysis method, analysis device, and analysis program

Abstract

The purpose of the invention is to accurately correlate a plurality of different types of events that have occurred in a single Web server, and to accurately detect an attack against a Web application. An event acquisition unit (151) acquires a log of events including an HTTP request to a Web server. An event correlation unit (152) creates, as an event block, a set of events including the HTTP request and events correlated therewith by employing process IDs of processes that processed the respective events included in the log. An attack detection unit (155) compares an event block created froma log of events to be subjected to attack detection with profiles in a profile list (143) created from normal events, and finds the degree of similarity, and if the degree of similarity is below or equal to a predetermined threshold, detects the event block as an event block including an abnormal event caused by an attack. The event correlation unit (152) also creates event blocks by employing transmission-source port numbers included in the respective events.

Description

technical field [0001] The present invention relates to an analysis method, an analysis device and an analysis program. Background technique [0002] In recent years, web applications are used for various services and are becoming part of the foundation of society. At the same time, attacks that maliciously exploit the vulnerabilities of web applications have also increased. If content falsification or information leakage occurs due to such an attack, it will cause great damage to the service provider, so it is necessary to detect the attack. [0003] In order to detect an attack on a web application, a technique is known that correlates a plurality of events of different types, such as an HTTP request event that occurs in the same web server, with other events. For example, HTTP requests and FireWall logs are compared, and events whose occurrence times are relatively recent are associated as related events (see Non-Patent Document 1). [0004] prior art literature [00...

AI Technical Summary

Problems solved by technology

At the same time, attacks that maliciously exploit the vulnerabilities of web applications have also increased

If content tampering or information leakage occurs due to such an attack, it will cause great damage to the service provider, so it is necessary to detect the attack

Images