Analysis method, analysis device and recording medium

Abstract

In order to correctly correlate multiple events of different types that occur in the same Web server, and to detect attacks on Web applications correctly, the event acquisition unit (151) acquires logs including events for HTTP requests to the Web server. The relevant part (152) uses the process ID of the process that processes the event contained in the log to make a collection of HTTP requests and events associated with it as an event module, and the attack detection part (155) uses the log of the event of the object of attack detection The generated event module is compared with the profiles of the profile list (143) created from normal events to obtain similarity, and when the similarity is below a predetermined threshold, it is detected as an event module containing an abnormal event based on an attack. The event-related unit (152) also creates an event module using the source port number included in the event.

Description

technical field [0001] The present invention relates to an analysis method, an analysis device and a recording medium. Background technique [0002] In recent years, web applications are used for various services and are becoming part of the foundation of society. At the same time, attacks that maliciously exploit the vulnerabilities of web applications have also increased. If content falsification or information leakage occurs due to such an attack, it will cause great damage to the service provider, so it is necessary to detect the attack. [0003] In order to detect an attack on a web application, a technique is known that correlates a plurality of events of different types, such as an HTTP request event that occurs in the same web server, with other events. For example, HTTP requests and FireWall logs are compared, and events whose occurrence times are relatively recent are associated as related events (see Non-Patent Document 1). [0004] prior art literature [000...

AI Technical Summary

Problems solved by technology

At the same time, attacks that maliciously exploit the vulnerabilities of web applications have also increased

If content tampering or information leakage occurs due to such an attack, it will cause great damage to the service provider, so it is necessary to detect the attack

Images