Analysis device, analysis method, and recording medium

Abstract

The analysis server (10) accumulates, in the storage section (12), an alarm of a communication that is determined to be a communication other than a normal communication based on a model representing characteristics of a normal communication. Then, the analysis server (10) uses the characteristic amounts of the communications included in the alarms as objects, and performs clustering using the characteristic amounts of the communications included in the alarms after excluding, from the accumulated alarms, alarms in which the category variable is different from the communication data used in the training of the model. Thereafter, the analysis server (10) determines, for each cluster generated by the clustering, whether the cluster is constituted by the same kind of alarms. Then, the analysis server (10) outputs the result of the clustering and the determination result of whether each cluster is constituted by the same kind of alarms.

Description

Technical Field

[0001] The present invention relates to an analysis apparatus, analysis method, and recording medium for analyzing alarms indicating communication anomalies. Background Technology

[0002] In existing technologies, when anomaly detection is performed based on a model representing the characteristics of normal communication, if new communication is added to the communication being detected, even if the added communication is normal, it will still be detected as an anomaly (over-detection). As a result, a large number of identical alarms may be generated. In this case, the user must determine whether each alarm on each terminal device is an over-detection. Therefore, if a large number of alarms are generated, the user's workload becomes enormous.

[0003] Therefore, several technologies have been proposed to reduce the user's workload. For example, there is a technology where, when the detection system issues an alarm, alarms with the same category variables such as threat type, terminal device ID, protocol, and port number are grouped together and alerted together (see Non-Patent Document 1). Additionally, there is a technology where the detection system filters alarms using category variables such as IP address, port number, and protocol number, or the communication start date and time, as keywords (see Patent Documents 1 and 2).

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2020-005184

[0007] Patent Document 2: Japanese Patent Application Publication No. 2020-135655

[0008] Non-patent literature

[0009] Non-patent document 1: NOZOMI Guardian, [Searched May 25, 2021], Internet URL: https: / / www.exclusive-networks.com / fr / wp-content / uploads / sites / 17 / 2020 / 12 / FR-VR-Nozomi-Networks-Guardian.pdf Summary of the Invention

[0010] The problem that the invention aims to solve

[0011] However, none of the aforementioned techniques can group alarms that share similar communication destinations but differ in data volume. Furthermore, even if alarm grouping based on data volume is desired using these techniques, the characteristics of each group become unclear as the number of features increases. Therefore, even with existing alarm grouping techniques, determining whether an alarm is caused by overdetection still requires a significant amount of work.

[0012] Therefore, the objective of this invention is to solve the above-mentioned problems and reduce the work required to determine whether an alarm is caused by over-detection.

[0013] Methods for solving problems

[0014] To address the aforementioned issues, the present invention is characterized by comprising: an accumulation unit that accumulates alarms for communications that are determined to be abnormal communications based on a model representing the characteristics of normal communications; a clustering unit that clusters the alarms using the characteristic quantities of the communications contained in the accumulated alarms; a determination unit that determines whether each cluster generated by the clustering is composed of the same type of alarm; and a result output unit that outputs the clustering result and the determination result of whether each cluster is composed of the same type of alarm.

[0015] Invention Effects

[0016] According to the present invention, the work required to determine whether an alarm is an over-detection can be reduced. Attached Figure Description

[0017] Figure 1 It is a diagram used to illustrate the structure and overview of the analysis system.

[0018] Figure 2 This is a diagram representing an example of the items used by the analysis server in the clustering of alerts.

[0019] Figure 3 This is a diagram representing an example of clustering performed by the analysis server.

[0020] Figure 4 This is a flowchart illustrating an example of the processing steps of an analysis server.

[0021] Figure 5 This is a flowchart illustrating an example of the processing steps of an analysis server.

[0022] Figure 6 This is a diagram illustrating an example of how users respond to alerts using the clustering results performed on the alerts by the analytics server.

[0023] Figure 7This is a diagram showing examples of the clustering results of alarms and the judgment results of the same type of alarms from the analysis server.

[0024] Figure 8 This is a diagram illustrating an example of the structure of a computer that executes an analysis program. Detailed Implementation

[0025] Hereinafter, embodiments (models) for carrying out the present invention will be described with reference to the accompanying drawings. The present invention is not limited to the embodiments described below.

[0026] [summary]

[0027] First, refer to Figure 1 The description includes an overview of the operation of the analysis system 1, including the analysis server (analysis device) 10.

[0028] The analysis system 1 includes a sensing device 2 and an analysis server 10. The sensing device 2 observes the communications of terminal devices (e.g., IoT devices).

[0029] For example, sensing device 2 observes the communication of the terminal device by mirroring the NW (network) device to which the terminal device is connected. Then, sensing device 2 generates information (processed information) by processing the observation results of the terminal device's communication, generates communication feature quantities based on the processed information, and sends them to analysis server 10.

[0030] In addition, the aforementioned communication characteristics include information such as the IP address of the terminal device conducting the communication, the source IP address of the session, the destination IP address of the session, the destination port number of the session, the protocol number, the session duration, the total number of forward bytes, the total number of forward packets, the total number of reverse bytes, and the total number of reverse packets.

[0031] The analysis server 10 determines whether the communication is normal based on the characteristic quantities of the communication sent from the sensing device 2 and the model representing the characteristics of normal communication. If the communication is determined to be abnormal, an alarm is output.

[0032] For example, the analysis server 10 calculates an anomaly score based on the difference between the feature quantity representing communication sent from the sensing device 2 and the model representing the feature quantity of normal communication. If the anomaly score exceeds a predetermined threshold, an alarm is output. Then, the user of the analysis system 1 confirms the alarm content, and if the alarm is an overdetection, feedback is provided. This feedback is, for example, as follows: the user registers the overdetection alarm with the analysis server 10, so that the analysis server 10 will not generate alarms for the same type of feature quantity in the future.

[0033] If a large number of alarms are generated, the user's confirmation process becomes cumbersome. Therefore, in order to enable users to perform the confirmation process efficiently (by performing confirmation of alarms of the same type together), the analysis server 10 clusters the alarms, making the characteristics of each cluster clearly apparent.

[0034] For example, when clustering alarms, the analysis server 10 excludes alarms from the clustering objects that are not included in the communication data used for training the model (e.g., communication based on new terminal devices). Furthermore, the analysis server 10 clusters alarms using features that are likely to exhibit communication characteristics (e.g., session duration, total forward bytes, total forward groups, total backward bytes, total backward groups, etc.). Moreover, when clustering alarms, the analysis server 10 obtains the difference between the value used in model training and the value for each item for each terminal device indicated by the alarm, and then clusters the alarms using the normalized values.

[0035] Thus, the analysis server 10 is able to perform alarm clustering that clearly represents the characteristics of each cluster.

[0036] Furthermore, the analysis server 10 determines whether the output of each cluster consists of the same type of alarm. This allows users to identify clusters whose alarms are composed of the same type and can be determined through a single over-detection check. As a result, the workload required to determine whether an alarm is an over-detection check is reduced.

[0037] In addition, when clustering alarms, the analysis server 10 does not rely on payload information that depends on a specific payload, so it can also handle the clustering of alarms from encrypted communications.

[0038] [Structure Example]

[0039] Next, refer to Figure 1 Here is an example of the structure of the analysis server 10. The analysis server 10 includes a storage unit 12, a feature quantity receiving unit 131, a training unit 132, an analysis unit (accumulation unit) 133, a screen display processing unit 134, a clustering unit 135, a decision unit 136, and a result output unit 137.

[0040] The storage unit 12 stores the information referenced by the analysis server 10 when performing various processes, and the execution results of various processes.

[0041] For example, the storage unit 12 stores the communication feature quantities obtained from the sensing device 2, a model showing the features of normal communication trained by the training unit 132, the communication tuple (initial tuple) of the feature quantities used in the training of the model, the analysis results of the analysis unit 133 on the communication (e.g., the above-mentioned anomaly score), and communication alarm groups that are determined to be abnormal based on the above-mentioned model.

[0042] In the following description, a portion of the categorical variables included in the feature quantities is referred to as a communication tuple. Specifically, the communication tuple of the feature quantities used for model training is referred to as the initial tuple. The initial tuple may include, for example, the IP address of the terminal device, the source IP address of the session, the destination IP address of the session, the destination port number of the session, and the protocol number contained in the feature quantities used in model training, but is not limited to these five.

[0043] The feature receiving unit 131 receives communication feature data from the sensing device 2. Then, the feature receiving unit 131 stores the received communication feature data in the storage unit 12. For example, the feature receiving unit 131 first receives the feature data of communication used for model training (feature data of normal communication) and stores it in the storage unit 12. After that, the feature receiving unit 131 receives the feature data of communication that is being detected and stores it in the storage unit 12.

[0044] The training unit 132 uses the communication feature quantities (normal communication feature quantities) stored in the storage unit 12 to train a model representing the features of normal communication. Afterwards, the training unit 132 stores the parameters of the trained model and the data used for model training (e.g., initial tuples) in the storage unit 12.

[0045] The analysis unit 133 uses the model trained by the training unit 132 to analyze communications that are the targets of detection. For example, the analysis unit 133 calculates an anomaly score, which represents the difference between the feature quantity of the communications being detected and the model described above. Then, if the anomaly score exceeds a predetermined threshold (i.e., if there is a high probability that the communications are not normal), the analysis unit 133 outputs an alarm. The alarm may include, for example, identification information of the communications being alerted, the date and time of the communications, etc. The output alarm is stored in the storage unit 12.

[0046] The screen display processing unit 134 displays the alarms stored in the storage unit 12 on a screen. For example, based on the user's input, the screen display processing unit 134 displays a list of alarms stored in the storage unit 12 on a screen. Thus, the user can confirm on the screen what kind of alarm was output.

[0047] The clustering unit 135 clusters alarms based on the communication characteristics contained in the alarms stored in the storage unit 12.

[0048] For example, the clustering unit 135 obtains alarms and characteristic quantities of communications that are the objects of the alarms from the storage unit 12. Then, the clustering unit 135 performs alarm clustering based on the obtained characteristic quantities of the communications. Here, the clustering unit 135 filters out the feature quantities used for clustering from the characteristic quantities of communications that are the objects of the alarms in a way that makes the characteristics of each cluster clearly apparent, and normalizes them.

[0049] For example, the clustering unit 135 excludes alarms from the clustered objects that are different from the communication tuples (initial tuples) of the feature quantities used for model training. For example, the clustering unit 135 compares the communication tuples (initial tuples) of the feature quantities used in model training with the communication tuples of the communication feature quantities contained in the alarms, and excludes alarms that are different from the clustered objects by class variables (a combination of the terminal device's own IP address, the source IP address of the session, the destination IP address of the session, the destination port number of the session, and the protocol number).

[0050] Thus, the clustering unit 135 can, for example, exclude alarms with clear reasons, such as those from communications with new terminal devices, from the clustered objects.

[0051] In addition, the clustering unit 135 performs clustering by excluding information such as the date and time of the communication occurrence and the anomaly score from the information contained in the alarm. For example, the clustering unit 135 performs alarm clustering using at least one of the characteristics of the communication contained in the alarm, namely session duration, total forward bytes, total forward packets, total backward bytes, and total backward packets.

[0052] Furthermore, the clustering unit 135 clusters alarms for each terminal device using the following value: the value is obtained by normalizing the difference between the value of the communication feature quantity used in the training of the model (the value during initial training) and the value of the communication feature quantity included in the alarm.

[0053] For example, for each terminal device, the clustering unit 135 calculates the differences between the values ​​of session duration, total forward bytes, total forward blocks, total backward bytes, and total backward blocks in the communication characteristics of the alarm and the values ​​during initial training. Then, the clustering unit 135 uses the values ​​after transforming the differences to a logarithmic scale to perform alarm clustering (see reference). Figure 2 ).

[0054] Figure 3Reference numeral 301 shows an example of the clustering results of clustering unit 135. Here, the results of clustering unit 135 clustering 165 alarms related to 5 terminal devices (Iot-A, Iot-B, Iot-C, Iot-D, Iot-E) based on five features: session duration, total forward bytes, total forward groups, total reverse bytes, and total reverse groups (cluster 0 to cluster 7) are shown. In addition, reference numeral 301 shows the state of the above-mentioned clustering results viewed from the direction of session duration and total reverse bytes.

[0055] Furthermore, the clustering algorithm used by the clustering unit 135 may be, for example, Birch or k-means. Users of the analysis server 10 can configure which clustering algorithm the clustering unit 135 uses.

[0056] return Figure 1 The determination unit 136 determines whether each cluster generated by the clustering unit 135 consists of alarms of the same type.

[0057] For example, the determination unit 136 determines whether each cluster consists of alarms of the same type based on the ratio of the number of alarms in each cluster to the total number of alarms, the number of terminal devices in each cluster that are the targets of alarms, the density of each cluster, etc.

[0058] For example, the determination unit 136 calculates a value of (number of alarms constituting the cluster / total number of alarms) for each cluster, and determines a cluster whose value is above a predetermined threshold (e.g., 70%) as a cluster consisting of alarms of the same type.

[0059] Additionally, for example, the determination unit 136 calculates how many terminal devices in each cluster are subject to alarms, and determines clusters whose calculated number is below a predetermined threshold (e.g., 1 device) as clusters consisting of the same type of alarm.

[0060] Additionally, for example, the determination unit 136 generates a scatter plot of clusters, calculates the density of a cluster using the area of ​​the cluster on the scatter plot and the number of alarms contained in that cluster, and determines clusters whose calculated density is above a predetermined threshold as clusters composed of the same type of alarms. For example, the determination unit 136 calculates (number of alarms constituting the cluster / area of ​​the cluster) for each cluster, and determines clusters whose calculated value is above a predetermined threshold (e.g., 1000) as clusters composed of the same type of alarms.

[0061] For example, consider the following situation: the decision unit 136 targets... Figure 3 The clusters (cluster 1 to cluster 7) shown by label 301 are determined to be clusters composed of the same type of alarm based on the information shown by label 302. The clusters that meet any one of the following conditions (1) to (3) are determined to be clusters composed of the same type of alarm.

[0062] (1) The ratio of the number of alarms in this cluster to the total number of alarms is over 70%.

[0063] (2) The number of terminal devices in this cluster that become alarm targets is 1.

[0064] (3) The density of the cluster is above 1000.

[0065] In addition, the information shown by reference numeral 302 is information on the number, area, and density of alarms for each terminal device (Iot-A, Iot-B, Iot-C, Iot-D, Iot-E) for each cluster (cluster 0 to cluster 7) shown by reference numeral 301.

[0066] Referring to the information shown in reference numeral 302, there is no cluster where the ratio of the number of alarms in a cluster to the total number of alarms is 70% or more. Cluster 0 (Cluster 0) is a cluster containing only IoT-C alarms, and its density is also 1000 or more. Cluster 3 (Cluster 3) is a cluster containing only IoT-E alarms, and its density is also 1000 or more. Therefore, the determination unit 136 determines that Cluster 0 and Cluster 3 are clusters composed of the same type of alarm.

[0067] return Figure 1 The output unit 137 outputs the clustering results performed by the clustering unit 135 and the determination results of the determination unit 136 on whether each cluster is composed of the same type of alarm.

[0068] For example, the result output unit 137 outputs... Figure 3 The clustering results shown by label 301, and the information that cluster 0 and cluster 3 in each of the clusters (cluster 1 to cluster 7) shown by label 301 are clusters composed of the same type of alarm.

[0069] Based on this analysis server 10, clusters that clearly represent the characteristics of each cluster can be generated when clustering alarms. Furthermore, the analysis server 10 outputs a determination result indicating whether each cluster consists of the same type of alarm. Thus, users can identify clusters that can be determined in a single over-detection judgment. As a result, the workload required to determine whether an alarm is over-detected can be reduced.

[0070] [Example of processing steps]

[0071] Next, use Figure 4 , Figure 5 This example illustrates the processing steps of analysis server 10. First, using... Figure 4 This section explains how to handle the accumulated alarms on server 10. Next, it uses... Figure 5 This describes the clustering process performed on the alarms accumulated by the analysis server 10.

[0072] First, the feature data receiving unit 131 of the analysis server 10 stores the communication feature data (normal communication feature data) sent from the sensing device 2 in the storage unit 12. Figure 4 (S1). Next, the training unit 132 uses the communication feature quantities accumulated in S1 to train a model representing the features of normal communication (initial training) (S2).

[0073] When the training of the model in S2 is completed, the feature receiving unit 131 stores the feature data of the communication as the detection target in the storage unit 12 (S3). Then, the analysis unit 133 calculates the anomaly score representing the difference between the feature data of the communication as the detection target and the model trained in S2 (S4).

[0074] Here, if the analysis unit 133 determines that the abnormal score calculated in S4 exceeds a predetermined threshold (S5: Yes), it generates an alarm for the communication and stores it in the storage unit 12 (S6). Then, if no processing has been performed on any of the communication targets (S7: No), the analysis server 10 performs the processing after S4 on the communication targets that have not yet been processed. On the other hand, if processing has been performed on all the communication targets (Yes in S7), the analysis server 10 ends the processing.

[0075] Furthermore, if the analysis unit 133 determines that the abnormal score calculated in S4 is below the prescribed threshold (S5: "No"), and no processing has been performed on a certain communication that is the target of detection (S7: "No"), then the processing after S4 is performed on the communication that has not yet been processed.

[0076] Next, use Figure 5 This indicates that the alarms accumulated on the analysis server 10 are clustered.

[0077] First, the clustering unit 135 of the analysis server 10 excludes alarms from the clustering objects that are different from the communication tuples (initial tuples) of the features used in the training of the model from the alarms stored in the storage unit 12. Figure 5 (S11).

[0078] For example, the clustering unit 135 compares the communication tuples used in the training of the model (initial tuples) with the communication feature tuples contained in the alarms, and excludes alarms whose categorical variables (a combination of the IP address of the terminal device, the source IP address of the session, the destination IP address of the session, the destination port number of the session, and the protocol number) are different from the initial tuples from the clustered objects.

[0079] After S11, the clustering unit 135 clusters the alarms based on the session duration, total number of forward bytes, total number of forward packets, total number of reverse bytes, and total number of reverse packets among the characteristics of the communication contained in the alarm (S12).

[0080] After S12, the determination unit 136 determines whether each cluster generated by the clustering in S12 is composed of the same type of alarm (S13).

[0081] For example, the determination unit 136 determines whether each cluster consists of the same type of alarm based on the ratio of the number of alarms in each cluster to the total number of alarms, the number of terminal devices that are the objects of alarms in each cluster, the density of each cluster, etc.

[0082] After S13, the result output unit 137 outputs the clustering results of S12 and the determination results of whether each cluster in S13 is a cluster composed of the same alarm (S14).

[0083] [Example of a user responding to an alarm]

[0084] Next, use Figure 6 This example illustrates how users respond to alarms by using the clustering results of alarms output by the analysis server 10 and the determination results of whether each cluster consists of the same type of alarm.

[0085] For example, after an alarm is generated, the analysis server 10 performs alarm clustering and determines whether each cluster is a cluster composed of the same type of alarm (S101: clustering).

[0086] Then, the user uses the clustering results of the alarms described above and the determination results of whether each cluster is composed of the same type of alarm to confirm the alarms. For example, the user performs the alarm confirmation process shown in S102 to S108 for each alarm or cluster unit until there are no unconfirmed alarms.

[0087] First, the user confirms whether the communication pattern of the object triggering the alarm is a new communication pattern that did not exist during model training (S102). Furthermore, the user confirms whether the communication parameters of the object triggering the alarm are new communication parameters of the trained communication pattern (S103). Based on the above confirmation results, the user inquires with the department to which the terminal device triggering the alarm belongs (S104). Then, if the inquiry result indicates that the terminal device has an anomaly (S105: Yes), the user takes appropriate action corresponding to the anomaly (S106). Then, the alarm confirmation process ends. Afterwards, the analysis server 10 continues monitoring.

[0088] On the other hand, if the query result indicates that the terminal device is not abnormal (S105: No), the user determines whether the alarm is caused by over-detection (S107). Then, if the user determines that the alarm is caused by over-detection (S107: Yes), over-detection feedback is provided (S108). At this time, the user provides over-detection feedback for clusters of the same type of alarm.

[0089] On the other hand, if the user determines that the alarm is not caused by over-detection (S107: No), no action is taken, and the alarm confirmation process ends. Then, the analysis server 10 continues to monitor the communication of the terminal device.

[0090] In this way, by using the clustering results of the alarms output by the analysis server 10 and the determination results of whether each cluster consists of the same type of alarm, users can determine whether an alarm has been over-detected and provide feedback on clusters of the same type of alarm. As a result, the work required to determine whether an alarm has been over-detected can be reduced.

[0091] [Experimental Results of Clustering]

[0092] Next, use Figure 7 This paper describes the experimental results of clustering alarms based on analysis server 10. Here, analysis server 10 generates alarms by applying a load to the communication being processed, which consists of two loads that are positively differentiable compared to normal communication and have a smaller positive difference (10). 0.2 times, 10 0.4 Four types of loads (10 times) that have a positive difference compared to normal communication and have a large positive difference. 1 times, 10 1.2 times, 10 1.4 times, 10 1.6 Three types of loads (10 times), which are negative differential compared to normal communication and have smaller negative differentials. -0.2 times, 10 -0.4 times, 10 -0.6 The analysis server 10 uses Birch in its alarm clustering algorithm, with a maximum cluster size of 10. The load patterns (based on differences in categorical variables) are categorized into 10 modes, including load patterns based on multiples of communication, load patterns based on differences in categorical variables, and load patterns based on communication changes.

[0093] Based on the above conditions, the clustering results of alarms related to communication in the above 10 modes analyzed by server 10 are as follows: Figure 7 As shown. Figure 7 As shown, among the 828 alarms excluding those based on different communication tuples, the largest cluster with an alarm ratio exceeding 70% contains 643 alarms.

[0094] Here, the analysis server 10 identifies the largest cluster with an alarm rate exceeding 70% as a cluster composed of the same type of alarms and outputs the identification result. This allows the user to make a one-time judgment on whether the cluster has passed detection. As a result, the 643 alarms mentioned above are reduced to 9 (1 per load), thus reducing the number of alarms the user needs to judge as passed detection from 939 to 305 (a reduction of 67.5%).

[0095] [System architecture, etc.]

[0096] Furthermore, the constituent elements of each part shown in the diagram are functional conceptual elements and do not necessarily need to be physically arranged as illustrated. That is, the specific methods of distributing and integrating the various devices are not limited to those shown in the diagram. They can be arranged in any unit, functionally or physically, in a distributed or integrated manner, depending on various loads, usage conditions, etc. Moreover, all or any part of the processing functions performed by each device can be implemented by the CPU and the program executed by the CPU, or by hardware through wiring logic.

[0097] Furthermore, all or part of the processes described in the above embodiments, which are performed as automatically, can be performed manually, or all or part of the processes described as manually performed can be performed automatically using known methods. In addition, the processing steps, control steps, specific names, and information including various data and parameters shown in the above text and figures can be arbitrarily changed, unless specifically stated otherwise.

[0098] [program]

[0099] The aforementioned analysis server 10 can be installed on a desired computer by installing the program as a package software or online software. For example, by executing the aforementioned program on an information processing device, the information processing device can function as the analysis server 10. The information processing device mentioned here includes desktop or laptop personal computers. In addition, information processing devices also include smartphones, mobile phones, mobile communication terminals such as PHS (Personal Handyphone System), and terminals such as PDAs (Personal Digital Assistants).

[0100] Alternatively, the analysis server 10 can also be installed as a server device that provides services related to the aforementioned processing to a user's terminal device as a client. In this case, the server device can be installed as a web server or as a cloud service that provides services related to the aforementioned processing through outsourcing.

[0101] Figure 8 This diagram illustrates an example of a computer executing an analysis program. Computer 1000, for example, includes a memory 1010 and a CPU 1020. Additionally, computer 1000 has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected via a bus 1080.

[0102] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program, such as a Basic Input Output System (BIOS). A hard disk drive interface 1030 is connected to a hard disk drive 1090. A disk drive interface 1040 is connected to a disk drive 1100. Removable storage media, such as hard disks or optical discs, are inserted into the disk drive 1100. A serial port interface 1050 is connected, for example, to a mouse 1110 and a keyboard 1120. A video adapter 1060 is connected, for example, to a monitor 1130.

[0103] Hard disk drive 1090 stores, for example, OS 1091, application program 1092, program module 1093, and program data 1094. That is, the programs specifying the various processes executed by the analysis server 10 described above are installed as program modules 1093 containing code executable by a computer. Program module 1093 is stored, for example, in hard disk drive 1090. For example, program module 1093 for performing processes with the same functional structure as those in analysis server 10 is stored in hard disk drive 1090. Alternatively, hard disk drive 1090 can be replaced by SSD (Solid State Drive).

[0104] Furthermore, the data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. Then, CPU 1020 reads the program module 1093 and program data 1094 stored in memory 1010 and hard disk drive 1090 into RAM 1012 and executes them as needed.

[0105] Furthermore, program module 1093 and program data 1094 are not limited to being stored in hard disk drive 1090; for example, they can also be stored in removable storage media and read by CPU 1020 via disk drive 1100, etc. Alternatively, program module 1093 and program data 1094 can also be stored in other computers connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Program module 1093 and program data 1094 can be read by CPU 1020 from other computers via network interface 1070.

[0106] Explanation of reference numerals in the attached figures

[0107] 1. Analysis System

[0108] 2. Sensing device

[0109] 10 Analysis Server

[0110] 12 Storage Department

[0111] 131 Feature Quantity Acceptance Department

[0112] Training Department 132

[0113] 133 Analysis Department (Accumulation Department)

[0114] 134 Display Processing Unit

[0115] 135 Clustering Department

[0116] 136 Judgment Department

[0117] 137 Result Output Department

Claims

1. An analytical apparatus, characterized in that, have: The accumulation section, whose accumulation is determined to be an alarm for communication that is not normal communication based on a model representing the characteristics of normal communication; The clustering unit uses the characteristic quantities of the communications contained in the accumulated alarms to cluster the alarms; The determination unit determines whether each cluster generated by the clustering is composed of the same type of alarm. as well as The results output section outputs the clustering results and a determination result on whether each cluster is composed of the same type of alarm. The clustering unit compares the feature values ​​of the communication used in the training of the model with the feature values ​​of the communication included in the alarm, and clusters alarms that have different combinations of the IP address of the terminal device of the communication, the source IP address of the session, the destination IP address of the session, the destination port number of the session, and the protocol number from the objects of the clustering.

2. The analytical apparatus according to claim 1, characterized in that, The clustering unit clusters the alarms using at least one of the following characteristics of the communication contained in the alarm: session duration, total forward bytes, total forward packets, total reverse bytes, and total reverse packets.

3. The analytical apparatus according to claim 1, characterized in that, For each terminal device, the clustering unit calculates the difference between the value of the feature quantity of the communication used in the training of the model and the value of the feature quantity of the communication included in the alarm, and uses the value of the difference of the feature quantity transformed into a logarithmic scale to cluster the alarm.

4. The analytical apparatus according to claim 1, characterized in that, The determination unit determines clusters whose generated clusters have a ratio of the number of alarms constituting the cluster to the total number of alarms that is above a predetermined threshold as clusters composed of the same type of alarms.

5. The analytical apparatus according to claim 1, characterized in that, For each generated cluster, the determination unit calculates how many terminal devices in the cluster are subject to alarms, and determines clusters whose calculated number of devices is below a specified threshold as clusters composed of the same type of alarm.

6. The analytical apparatus according to claim 1, characterized in that, The determination unit creates a scatter plot of the generated clusters, calculates the density of the clusters using the area of ​​the clusters on the scatter plot and the number of alarms contained in the clusters, and determines clusters whose calculated density is above a predetermined threshold as clusters composed of the same type of alarms.

7. An analytical method performed by an analytical apparatus, characterized in that, The process includes the following steps: An alarm is triggered when a model representing the characteristics of normal communication is used to identify communication that is not normal. Clustering of the alarms is performed using the characteristic quantities of the communications contained in the accumulated alarms; For each cluster generated by the clustering, it is determined whether the cluster consists of the same type of alarm; as well as Output the clustering results and the determination results of whether each cluster is composed of the same type of alarm. The feature quantities of communication used in the training of the model and the feature quantities of communication included in the alarm are compared, and alarms with different combinations of the IP address of the terminal device of the communication, the source IP address of the session, the destination IP address of the session, the destination port number of the session, and the protocol number are excluded from the clustered objects for clustering.

8. A recording medium storing an analysis program for causing a computer to perform the following steps: An alarm is triggered when a model representing the characteristics of normal communication is used to identify communication that is not normal. Clustering of the alarms is performed using the characteristic quantities of the communications contained in the accumulated alarms; For each cluster generated by the clustering, it is determined whether the cluster consists of the same type of alarm; as well as Output the clustering results and the determination results of whether each cluster is composed of the same type of alarm. The feature quantities of communication used in the training of the model and the feature quantities of communication included in the alarm are compared, and alarms with different combinations of the IP address of the terminal device of the communication, the source IP address of the session, the destination IP address of the session, the destination port number of the session, and the protocol number are excluded from the clustered objects for clustering.

Images