Attack detection device, attack detection method, and attack detection program

Abstract

An attack detection device (100) is provided with an attack detection unit (120), a pattern determination unit (130), and a final determination unit (140). The attack detection unit (120) executes an attack detection process for determining whether or not the target data complies with any of the rules included in a permission list including a plurality of rules to which unique identifiers are assigned, respectively, using the plurality of pieces of communication data as the target data. The pattern determination unit (130) executes a pattern determination process for determining, using a model for determining whether or not an appearance pattern of an identifier corresponding to a rule followed by each of the plurality of communication data is normal, whether or not an identifier corresponding to a rule followed by the target data matches an appearance pattern of an identifier derived from the model. When the pattern determination process is executed, the final determination unit (140) determines whether or not the target data is normal using the determination result of the attack detection process and the determination result of the pattern determination process.

Description

Technical Field

[0001] The present disclosure relates to an attack detection device, an attack detection method, and an attack detection program. Background Art

[0002] In recent years, with the opening or networking of industrial control systems, the threat of cyber attacks against industrial control systems has increased. As one of the countermeasures against cyber attacks that invade through the network, there is an attack detection system that captures attack activities by monitoring network communications. In particular, in industrial control systems, as an attack detection method that utilizes the fact that network communications are fixed, there are two methods: making a destination IP (Internet Protocol) address or port number of a normal communication packet as a permission list, and detecting a communication packet that does not comply with the created permission list as an attack; and more generally defining the characteristics of a normal communication packet, and detecting a communication packet that deviates from the defined characteristics.

[0003] On the other hand, there are network attacks that are carried out by combining normal communication packets, in which the above-mentioned method is bypassed to launch the network attack. As methods for detecting such more advanced network attacks, there are methods of updating the permission list according to the system status, a method of setting the permission list as a list showing characteristics such as the order or frequency of occurrence of communication packets across multiple communication packets, and a method of further using other criteria to perform attack determination on communication packets determined to be normal using the permission list, etc.

[0004] Patent document 1 discloses a technology for determining communication in two stages. Here, in the first stage, attack detection using a permission list is performed, and communications that do not comply with the rules included in the permission list are determined to be attacks. In the second stage, whether the communication is an attack is determined based on the degree of abnormality of the communication that complies with the rules included in the permission list.

[0005] Prior art literature

[0006] Patent Literature

[0007] Patent Document 1: International Publication No. 2019 / 240020 Pamphlet Summary of the invention

[0008] Problem that the invention aims to solve

[0009] According to the technology disclosed in Patent Document 1, when judging one communication data using feature amounts corresponding to a plurality of elements related to the communication data, it is necessary to calculate the feature amounts using the plurality of elements, so there is a problem that the processing load becomes relatively high.

[0010] The purpose of the present disclosure is to, in a method for further using other criteria to perform attack judgment on a communication packet judged to be normal using a permission list, not to calculate the feature quantity using the multiple elements when judging the communication data using feature quantities corresponding to the multiple elements of the communication data.

[0011] Means used to solve problems

[0012] The attack detection device disclosed in the present invention comprises: an attack detection unit, which performs attack detection processing, in which a plurality of communication data are respectively used as object data, and determines whether the object data complies with any rule included in a permission list, wherein the permission list includes a plurality of rules to which inherent identifiers are respectively assigned; a style determination unit, which performs style determination processing when the object data complies with any rule included in the permission list, in which a model for determining whether the appearance pattern of the identifier corresponding to the rule followed by each of the plurality of communication data is normal is used to determine whether the identifier corresponding to the rule followed by the object data matches the appearance pattern of the identifier derived from the model; and a final determination unit, which, when the style determination processing is performed, uses the determination result of the attack detection processing and the determination result of the style determination processing to determine whether the object data is normal.

[0013] Effects of the Invention

[0014] According to the present disclosure, when the object data complies with any of the rules included in the permission list, it is determined whether the identifier corresponding to the rule followed by the object data matches the appearance pattern of the identifier derived from the model. Here, the model is used to determine whether the appearance pattern of the identifier corresponding to the rule followed by each of the plurality of communication data is normal. Therefore, according to the present disclosure, in a method for further using other criteria to perform attack determination on a communication packet determined to be normal using the permission list, when the feature quantity corresponding to a plurality of elements about one communication data is used to determine the one communication data, the feature quantity is not calculated using the plurality of elements. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram showing a functional configuration example of the attack detection device 100 according to the first embodiment.

[0016] Figure 2 The figures are for explaining a functional configuration example of the attack detection unit 120 according to the first embodiment. (a) is a figure showing a functional configuration example of the attack detection unit 120 , and (b) is a figure showing a specific example of the permission list 122 .

[0017] Figure 3This is a diagram showing a functional configuration example of the pattern determination unit 130 according to the first embodiment.

[0018] Figure 4 The figures are for explaining a functional configuration example of the final determination unit 140 according to the first embodiment. (a) is a figure showing a functional configuration example of the final determination unit 140 , and (b) is a figure showing a specific example of the determination integration unit 141 .

[0019] Figure 5 The diagrams are for explaining the format of the rule numbers in the first embodiment, (a) is a diagram for explaining the processing of the attack detection unit 120, and (b) is a diagram for explaining the rule number sequence.

[0020] Figure 6 This is a diagram for explaining the format of rule numbers in the first embodiment.

[0021] Figure 7 This is a diagram for explaining the processing of the determination unit 133 according to the first embodiment.

[0022] Figure 8 This is a diagram showing a hardware configuration example of the attack detection device 100 according to the first embodiment.

[0023] Fig. 9 This is a flowchart showing the operation of the attack detection device 100 according to the first embodiment.

[0024] Fig.10 This is a diagram showing a hardware configuration example of the attack detection device 100 according to a modification of the first embodiment.

[0025] Fig.11 This is a diagram showing a functional configuration example of the style determination unit 130 according to the second embodiment.

[0026] Fig.12 This is a diagram showing a specific example of the style classification information 136 according to the second embodiment.

[0027] Fig.13 This is a diagram illustrating the style classification of implementation mode 2.

[0028] Fig.14 This is a diagram for explaining the processing of the checking unit 121 according to the third embodiment.

[0029] Fig.15 This is a diagram for explaining the processing of the checking unit 121 according to the third embodiment.

[0030] Fig.16 This is a diagram for explaining the processing of the checking unit 121 according to the third embodiment.

[0031] Fig.17This is a diagram for explaining the communication data 202 according to the third embodiment. DETAILED DESCRIPTION

[0032] In the description of the embodiments and the accompanying drawings, the same reference numerals are used for the same elements and corresponding elements. The description of the elements marked with the same reference numerals is appropriately omitted or simplified. The arrows in the figures mainly show the flow of data or the process. In addition, the word "unit" can also be appropriately rewritten as "circuit", "process", "procedure", "processing" or "circuit".

[0033] Implementation method 1.

[0034] Hereinafter, this embodiment will be described in detail with reference to the drawings.

[0035] ***Structure description***

[0036] Figure 1 is a block diagram showing an example of the functional structure of the attack detection device 100. Figure 1 As shown, the attack detection device 100 includes a communication data acquisition unit 110, an attack detection unit 120, a pattern determination unit 130, a final determination unit 140, and a determination result output unit 150. The attack detection unit 120 is also called a permission list attack detection unit. The pattern determination unit 130 is also called a rule number pattern determination unit.

[0037] The communication data acquisition unit 110 acquires the communication data 202 .

[0038] The communication data 202 is communication data to be detected and is communication data input to the attack detection unit 120 .

[0039] The attack detection unit 120 determines whether the communication data 202 is data permitted by the permission list 122. The attack detection unit 120 performs attack detection processing in which each of the plurality of communication data 202 is used as target data and determines whether the target data complies with any rule included in the permission list 122.

[0040] The permission list 122 is a whitelist that defines the characteristics of permitted communications as rules, and is data showing an identifier of each rule and a list of characteristics of communications permitted by each rule. As a specific example, the identifier of a rule is a rule number. The permission list 122 generally includes a plurality of rules. A unique identifier is assigned to each rule.

[0041] The pattern determination unit 130 determines the communication data 202 determined to be permitted by the permission list 122 based on the rule number 206 corresponding to the communication data 202. When the object data complies with any of the rules included in the permission list 122, the pattern determination unit 130 performs the following pattern determination processing, in which a model related to the appearance pattern of the identifier is used to determine whether the identifier corresponding to the rule complied with by the object data matches the appearance pattern of the identifier derived from the model. The model is used to determine whether the appearance pattern of the identifier corresponding to the rule complied with by each of the plurality of communication data 202 is normal. When the identifier corresponding to the object data matches the appearance pattern of the identifier derived from the model, as a specific example, the identifier estimated to be the identifier corresponding to the object data based on the appearance pattern is consistent with the identifier corresponding to the actual object data, or the property represented by the appearance pattern does not contradict the property represented by the appearance pattern of the identifier corresponding to each of all the communication data 202 that have been received at the time when the object data is received. The pattern determination unit 130 may learn a model related to the appearance pattern of the identifier using the plurality of communication data 202 determined to be normal and the appearance patterns of the identifiers respectively corresponding to the plurality of communication data 202 determined to be normal.

[0042] The rule number 206 is an identifier of each rule, and is used to confirm which rule included in the permission list 122 the communication data 202 complies with when the communication data 202 is determined to be permitted communication.

[0043] The final determination unit 140 determines the final determination result by synthesizing the determination result 205 and the determination result 303. When the style determination process is executed, the final determination unit 140 uses the determination result of the attack detection process and the determination result of the style determination process to determine whether the object data is normal. When the object data is normal, as a specific example, the object data is not attack-related data. When it is determined in the attack detection process that the object data does not comply with any of the rules included in the permission list 122, the final determination unit 140 determines that the object data is abnormal. When it is determined in the attack detection process that the object data complies with any of the rules included in the permission list 122, when it is determined in the style determination process that the identifier corresponding to the rule followed by the object data does not match the appearance pattern derived from the model, the final determination unit 140 determines that the object data is abnormal.

[0044] The determination result 205 is data indicating the determination result of the attack detection unit 120 , and is data indicating whether the communication data 202 is permitted communication.

[0045] The determination result 303 is data indicating the determination result of the style determination unit 130 .

[0046] The determination result output unit 150 outputs the final determination result.

[0047] Figure 2 (a) is a block diagram showing an example of the functional configuration of the attack detection unit 120. Figure 2 As shown in (a) of FIG. 1 , the attack detection unit 120 includes a checking unit 121 and a permission list 122 .

[0048] The checking unit 121 checks the communication data 202 against the permission list 122 to determine whether the communication of the communication data 202 is permitted communication. The checking unit 121 outputs a determination result 205 and a rule number 206 .

[0049] Figure 2 (b) shows a specific example of the permission list 122.

[0050] As shown in this example, in the permission list 122 of this embodiment, a rule number as an identifier is assigned to each rule without duplication, and the rule number corresponds to the rule one-to-one. In addition, the identifier is represented by an integer or a value corresponding to the integer one-to-one. That is, the identifier can be processed as an integer in a computer.

[0051] On the other hand, the communication feature is usually expressed in the form of combining multiple items of different types in order to make the accuracy of attack detection relatively high. In this example, the communication feature is composed of seven items: protocol, source IP (Internet Protocol) address, source port, destination IP address, destination port, data length, and payload. In this way, in the permission list 122 of this embodiment, one identifier is assigned to the feature of one communication composed of multiple items. In addition, from the perspective of processing efficiency in the computer, it is obvious that the method of processing one identifier is more efficient than processing one communication feature by combining multiple items of different types.

[0052] Figure 3 1 is a block diagram showing an example of the functional configuration of the style determination unit 130. Figure 3 As shown, the style determination unit 130 includes a model learning unit 131 , a model storage unit 132 , a determination unit 133 , and a model acquisition unit 134 .

[0053] The determination unit 133 determines whether the rule number 206 is normal, and outputs the determination result as the determination result 303. In determining whether the rule number 206 is normal, the determination unit 133 compares the rule number 206 with a rule number model. The rule number model is obtained by modeling the appearance pattern of normal rule numbers.

[0054] The model learning unit 131 receives the rule 302 corresponding to the normal communication data 202 as input, and learns the rule number model.

[0055] The model acquisition unit 134 acquires a rule numbering model through external input.

[0056] The model storage unit 132 stores the rule numbering model learned by the model learning unit 131 or the rule numbering model acquired from the outside by the model acquisition unit 134 .

[0057] Figure 4 (a) is a block diagram showing an example of the functional configuration of the final determination unit 140. Figure 4 As shown, the final determination unit 140 includes a determination integration unit 141 .

[0058] In this embodiment, two determination results, determination result 205 of attack detection unit 120 and determination result 303 of pattern determination unit 130, are obtained for communication data 202. Determination synthesis unit 141 determines a final determination result by synthesizing these two determination results and outputs the determined determination result.

[0059] Figure 4 (b) shows a specific example of the processing of the judgment synthesis unit 141. As a specific example, the judgment synthesis unit 141 adopts a method of calculating the logical sum of two inputs as a synthesis method of the judgment result. That is, when a certain communication data 202 is judged as an attack in at least one of the attack detection unit 120 and the pattern judgment unit 130, the certain communication data 202 is finally judged as an attack. Therefore, if a certain communication data 202 is judged as an attack in the attack detection unit 120, the certain communication data 202 is judged as an attack in the final judgment unit 140. In addition, even if a certain communication data 202 is judged as normal in the attack detection unit 120, if the certain communication data 202 is judged as an attack in the pattern judgment unit 130, the certain communication data 202 is also judged as an attack in the final judgment unit 140. In addition, judging the communication data 202 as an attack includes judging the communication corresponding to the communication data 202 as an attack.

[0060] use Figure 5 , the pattern of the rule number is explained. When normal packets are continuously input to the attack detection unit 120, the rule number corresponding to each packet is continuously output from the attack detection unit 120. The rule number corresponding to each packet is a rule number indicating the rule followed by each packet.

[0061] Figure 5(a) shows a case where, when a packet sequence 501 is input, a rule number sequence 502 is output from the attack detection unit 120, and the rule number sequence 502 is composed of rule numbers corresponding to each packet of the input packet sequence 501. Here, the packet sequence 501 is composed of normal packets.

[0062] Figure 5 (b) shows a specific example of the sequence 503. The sequence 503 is an example of the rule number sequence 502 corresponding to the normal packet sequence 501. Figure 5 (b) shows a situation where, when normal packets are input to the attack detection unit 120 in the order in which the normal packets are received, the rule numbers corresponding to the input packets are output in the order of 0, 1, 0, 2, 1, 3, 4, 1, 5, ... In addition, the graph 504 is a graph obtained by plotting the elements of the rule number column 502 with the horizontal axis as the time and the vertical axis as the rule number. The horizontal axis represents the time when the packet corresponding to each element of the rule number column 502 is received. Here, in the graph 504, the regularity of the rule number column 502 appears in a geometric pattern. In this way, in the present embodiment, a rule number is assigned to each rule included in the permission list 122, and each rule is corresponded to each rule number, thereby making the regularity of the rules corresponding to the normal packets clear as the regularity of the rule numbers.

[0063] Figure 6 Another specific example of the format of the rule number is shown. Figure 6 This is a histogram showing the number of communication data 202 corresponding to each rule number of the permission list 122 when a total of 100 normal communication data 202 are assigned. According to the histogram, most of the normal communication data 202 (about 40 percent) corresponds to rule number 1, and a small part of the normal communication data 202 (about 4 percent) corresponds to rule number 8, etc.

[0064] The model learning unit 131 learns the pattern of the rule number as described above. In addition, the method used by the model learning unit 131 for learning is arbitrary, but as a specific example, it is known that a method called LSTM (Long Short Term Memory) is applied to time series data such as the graph 504. In addition, Figure 6 The histogram shown can be generated by counting the number of communication data 202 corresponding to each rule number.

[0065] Furthermore, as described above, the computer processing efficiency is higher when calculating the feature quantity of a rule number represented by a single integer than when calculating the feature quantity of a communication composed of multiple different types of items. Therefore, by learning the pattern of the rule number, the learning cost can be reduced.

[0066] Figure 7 The following is an example of the operation of the determination unit 133. Here, 0, 1, 0, 2, 1, 3, 4, 1, 5, ... are learned as a rule number model as the order of rule numbers corresponding to normal communication data 202. The determination unit 133 uses the rule number model to predict the rule number that the normal communication data 202 received next should correspond to, and based on the predicted rule number, determines whether the rule number corresponding to the communication data 202 actually received during attack detection is correct.

[0067] Here, it is assumed that the rule numbers corresponding to the communication data 202 received in the attack detection are 0, 1, 0, 2, 1, 2 in the order in which the communication data 202 is received. At this time, the rule number "2" corresponding to the communication data 202 received last is not the rule number "3" that the communication data 202 should correspond to. Therefore, the determination unit 133 determines that the communication data 202 is an attack. In addition, in this example, it is determined to be an attack when the rule numbers are not strictly consistent, but it may also be that it is not determined to be an attack even when the rule numbers are not strictly consistent. As a specific example, the rule number model may also be a model that shows the probabilistic properties or statistical properties of the pattern of the rule numbers, and the determination unit 133 may also determine that it is an attack when the probabilistic properties or statistical properties represented by the model are inconsistent with the pattern of the rule numbers.

[0068] Figure 8 1 is a hardware configuration example of the attack detection device 100, and shows an example of a computer that realizes the attack detection device 100. In this example, as seen in a general computer, a processor 902, a main storage device 903, an auxiliary storage device 904, an input interface 906, a display interface 907, and a network interface 908 are connected via a data bus 905. The attack detection device 100 may also be composed of a plurality of computers.

[0069] The processor 902 is an IC (Integrated Circuit) that performs calculations and controls hardware included in the computer. As a specific example, the processor 902 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit).

[0070] A plurality of processors may be provided instead of the processor 902. The plurality of processors share the role of the processor 902.

[0071] The main storage device 903 is typically a volatile storage device, and a specific example is a RAM (Random Access Memory). The main storage device 903 is also called a main memory. The data stored in the main storage device 903 is stored in the auxiliary storage device 904 as needed.

[0072] The auxiliary storage device 904 is typically a nonvolatile storage device, and specific examples thereof include ROM (Read Only Memory), HDD (Hard Disk Drive), or flash memory. Data stored in the auxiliary storage device 904 is loaded into the main storage device 903 as needed.

[0073] The input interface 906 is a port connected to an input device, and a specific example is a USB (Universal Serial Bus) terminal. A specific example of the input device is a keyboard and a mouse.

[0074] The display interface 907 is a port connected to a display device, and as a specific example, is an HDMI (registered trademark, High-Definition Multimedia Interface) terminal. As a specific example, the display device is a monitor.

[0075] The network interface 908 is a receiver and a transmitter. As a specific example, the network interface 908 is a communication chip or a NIC (Network Interface Card).

[0076] The processing of the attack detection unit 120 and the pattern determination unit 130 is implemented as an attack detection program as a software program, and the attack detection program is usually stored in the auxiliary storage device 904. The attack detection program is read by the processor 902 into the higher-speed main storage device 903 and executed.

[0077] The attack detection program may also be recorded in a computer-readable non-volatile recording medium. As a specific example, the non-volatile recording medium is an optical disk or a flash memory. The attack detection program may also be provided as a program product.

[0078] The data used when executing the attack detection program and the data obtained by executing the attack detection program are appropriately stored in the storage device. Each part of the attack detection device 100 appropriately uses the storage device. As a specific example, the storage device is composed of at least one of the main storage device 903, the auxiliary storage device 904, the register in the processor 902, and the cache memory in the processor 902. In addition, data and information sometimes have the same meaning. The storage device can also be a device independent of the computer.

[0079] When attack detection is performed in real time, the communication data 202 that is the acquisition target of the communication data acquisition unit 110 is acquired from the network interface 908. On the other hand, when attack detection is performed on the communication data 202 that has been acquired in the past, it is also considered to acquire the communication data 202 stored in the auxiliary storage device 904. The result of the attack detection is displayed visually through the display interface 907, or notified to a remote operator through the network interface 908. In addition, the input interface 906 can also be used for the setting of the attack detection device 100. As a specific example, the editing of the permission list 122 and the rule number model is considered as the setting of the attack detection device 100.

[0080] In addition, when the attack detection device 100 is implemented in a router as a specific example, the attack detection device 100 may not have the input interface 906 and the display interface 907. In addition, it is also considered that part or all of the attack detection processing is not software but is installed in the form of hardware. In this case, the attack detection device 100 is also considered to be a device with a logic circuit such as an FPGA (Field Programmable Gate Array).

[0081] ***Action description***

[0082] The operation process of the attack detection device 100 corresponds to the attack detection method. In addition, the program that realizes the operation of the attack detection device 100 corresponds to the attack detection program.

[0083] Fig. 9 2 is a flowchart showing an example of the overall operation of the attack detection device 100. Fig. 9 The operation of the attack detection device 100 will be described.

[0084] (Step S801)

[0085] The communication data acquisition unit 110 acquires the communication data 202 that is the target of attack detection.

[0086] (Step S802)

[0087] The checking unit 121 checks the acquired communication data 202 with the permission list 122 .

[0088] (Step S803)

[0089] When the acquired communication data 202 complies with any rule included in the permission list 122, the attack detection device 100 proceeds to step S806. In all other cases, the attack detection device 100 proceeds to step S804.

[0090] (Step S804)

[0091] The checking unit 121 determines that the acquired communication data 202 is an attack.

[0092] (Step S805)

[0093] The judgment integration unit 141 makes a final judgment by integrating the judgment result of the checking unit 121 and the judgment result of the judgment unit 133. If there is no judgment result of the judgment unit 133, the judgment integration unit 141 makes a final judgment without using the judgment result of the judgment unit 133.

[0094] The determination integration unit 141 outputs data indicating the result of the final determination.

[0095] (Step S806)

[0096] Step S806 is composed of steps S807 to S812. After the process of step S806 by the determination unit 133 is completed, the attack detection device 100 proceeds to step S805.

[0097] (Step S807)

[0098] The determination unit 133 acquires the rule number corresponding to the acquired communication data 202 .

[0099] (Step S808)

[0100] The determination unit 133 reads the rule numbering model from the model storage unit 132 and determines whether the acquired rule number is suitable for the read rule numbering model.

[0101] (Step S809)

[0102] The model learning unit 131 learns the rule numbers acquired in step S807 in parallel with the process of step S808 , thereby updating the rule number model.

[0103] (Step S810)

[0104] In step S808, when the determination unit 133 determines that the acquired rule number does not fit the read rule number model, the process proceeds to step S811. Otherwise, the process proceeds to step S812.

[0105] (Step S811)

[0106] The determination unit 133 determines that the acquired communication data 202 is an attack.

[0107] (Step S812)

[0108] The determination unit 133 determines that the acquired communication data 202 is not an attack.

[0109] **Description of the effects of Embodiment 1**

[0110] As described above, according to the present embodiment, a unique identifier is assigned to each rule included in the permission list 122, so that one identifier represents the characteristic quantity of the communication data 202 which is usually represented by a plurality of items of different types, and the represented identifier is used as a learning object. Therefore, the cost of learning the timing or statistical characteristics of normal communication can be reduced.

[0111] Furthermore, according to the present embodiment, in the detection of the permission list attack, the process of extracting the feature quantity to be learned is realized by the process of obtaining the identifier corresponding to the rule followed by the communication data 202. Therefore, according to the present embodiment, the cost of extracting the feature quantity required for learning can be reduced.

[0112] Therefore, according to the present embodiment, in attack detection that combines permission list-based attack detection and learning-based attack detection, it is possible to implement attack detection with relatively high accuracy using relatively few computing resources.

[0113] ***Other structures***

[0114] <Variation 1>

[0115] Fig.10 A hardware configuration example of the attack detection device 100 according to this modification is shown.

[0116] The attack detection device 100 includes a processing circuit 909 instead of the processor 902 , the processor 902 and the main storage device 903 , the processor 902 and the auxiliary storage device 904 , or the processor 902 , the main storage device 903 , and the auxiliary storage device 904 .

[0117] The processing circuit 909 is hardware that realizes at least a part of each unit included in the attack detection device 100 .

[0118] The processing circuit 909 may be dedicated hardware, or may be a processor that executes a program stored in the main storage device 903 .

[0119] When the processing circuit 909 is dedicated hardware, as a specific example, the processing circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0120] The attack detection device 100 may include a plurality of processing circuits instead of the processing circuit 909. The plurality of processing circuits share the role of the processing circuit 909.

[0121] In the attack detection device 100 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0122] As a specific example, the processing circuit 909 is implemented by hardware, software, firmware, or a combination thereof.

[0123] The processor 902, the main storage device 903, the auxiliary storage device 904, and the processing circuit 909 are collectively referred to as a “processing circuit.” That is, the functions of each functional component of the attack detection device 100 are implemented by the processing circuit.

[0124] The attack detection device 100 according to other embodiments may have the same structure as that of this modification.

[0125] Implementation method 2.

[0126] Hereinafter, the differences from the above-described embodiment will be mainly described with reference to the drawings.

[0127] ***Structure description***

[0128] In the first embodiment, by learning the pattern of the identifier corresponding to the normal communication data 202, the pattern of the normal communication data 202 can be learned relatively efficiently. However, according to the first embodiment, when various possible patterns of the normal communication data 202 are given, it is unclear how to select an appropriate learning method. Here, in the case where information related to the specifications of the target system is obtained, the meaning of each rule and the possible patterns of the identifier can be known in advance from the information. Therefore, in this case, a learning method suitable for each pattern of the rule number can be selected, and a rule number model can be directly generated without using a learning method. The purpose of this embodiment is to effectively utilize information related to the specifications of the target system.

[0129] Fig.11 1 is a block diagram showing an example of the functional configuration of the style determination unit 130 according to the present embodiment. Fig.11As shown, the pattern determination unit 130 further includes a learning method selection unit 135 and pattern classification information 136. The pattern determination unit 130 selects a method for learning a model related to the appearance pattern of the identifier based on the classification of the appearance pattern of the identifier corresponding to each of the plurality of communication data 202 determined to be normal.

[0130] The style classification information 136 is information generated based on the specification information 137 and is information indicating style classification.

[0131] The specification information 137 is information acquired in advance, and is information indicating the specifications of the target system and the like.

[0132] The learning method selection unit 135 selects a learning method suitable for the pattern of the rule number using the pattern classification information 136 .

[0133] The model learning unit 131 learns the rule numbering model using the learning method selected by the learning method selection unit 135 .

[0134] In addition, a rule numbering model may be created in advance based on the specification information 137. When a rule numbering model is created in advance, the model acquisition unit 134 may acquire the created rule numbering model.

[0135] Fig.12 A specific example of the style classification information 136 is shown. Fig.13 To explain the meaning of each style classification.

[0136] Fig.13 A specific example of style classification is shown. Fig.13 In FIG. 1 , as specific examples of pattern classification, patterns of cyclic transmission 21, command / response 22, number of times limit 23, instantaneous transmission 24, data regularity 25, and rare communication 26 are shown. Fig.13 Specific examples of each style are shown in FIG.

[0137] As a specific example, in a control system, communication that occurs periodically is sometimes referred to as cyclic transmission, and communication that occurs randomly is sometimes referred to as transient transmission, thereby distinguishing between the two.

[0138] In the cyclic transmission 21, communication data 202 corresponding to rule number 3 appears at intervals of 1 minute. As a specific example, for this type of communication, a learning method suitable for periodic data or time series data is selected. Here, Figure 5The pattern shown in the graph 504 of can also be regarded as cyclic transmission. In the graph 504, the plurality of rule numbers as a whole show a periodic pattern. Therefore, when the model learning unit 131 uses the graph 504 as learning data, the plurality of rule numbers as a whole can be taken as objects to learn the pattern. On the other hand, in this case, the model learning unit 131 can also regard it as a superposition of a plurality of periodic rule numbers and learn each rule number separately.

[0139] Unlike cyclic transmission, in transient transmission, rule numbers and time intervals that appear are usually irregular as shown in transient transmission 24. Therefore, when communication is transient transmission, the same learning method as that in cyclic transmission is likely to be inappropriate.

[0140] In the instantaneous transmission 24, as a specific example, it is assumed that the communication data 202 is generated by a manual operation, and it is considered that learning is performed in a case where the appearance interval of the rule number is not fixed and the appearance interval varies greatly.

[0141] Command / response 22 shows the pattern of rule numbers corresponding to command / response type communication. In command / response type communication, as a specific example, when a Read command is sent from a control device to a device, a sensor value is sent from the device to the control device as a response to the Read command.

[0142] The command / response 22 indicates a simple command / response in which the communication data 202 corresponding to the rule number 1 and the communication data 202 corresponding to the rule number 2 are exchanged once.

[0143] More generally, when the communication data 202 appears according to a predetermined rule as a communication protocol, a method of learning the rule as a state transition diagram may be selected. In addition, a case where the communication protocol is defined as a state transition diagram in advance as the specification information 137 may also be considered. In this case, the model acquisition unit 134 may acquire the defined state transition diagram.

[0144] The number limit 23 indicates that the number of times the communication corresponding to the rule number 4 is permitted within a certain period is limited. In the number limit 23, the communication that implements the password authentication request is only permitted up to 3 times within 1 hour, that is, if the password authentication fails 3 times within 1 hour, the password authentication action cannot be performed within a certain period of time. In addition, this number limit related to password authentication should originally be implemented as an authentication system, but here, the number limit is shown as a specific example.

[0145] Data regularity 25 indicates communication in which rule number 200 sends temperature data. In data regularity 25, the temperature indicated by the temperature data fluctuates greatly from 0→90→50. Here, it is not normal behavior for the temperature obtained by the same sensor in a short period of time to fluctuate greatly in a short period of time. Therefore, when the value represented by the communication data 202 fluctuates greatly, the determination unit 133 can determine that the communication data 202 is an attack. In such a case, the learning method selection unit 135 can use the communication data 202 to select the following method: learn a model related to the system being monitored and controlled, specifically, a model related to temperature changes. Alternatively, in data regularity 25, when the value related to the communication does not change at all unnaturally, the communication is determined to be an attack.

[0146] Rare communication 26 indicates a communication in which communication data 202 corresponding to rule number 1000 is rarely received. Regarding such communication, consider Figure 6 The learning of the statistical model shown in the figure can also be used to determine the accuracy of the occurrence frequency of the rule number that rarely appears, and it can also be used to urge vigilance against receiving rare communication data 202, even if the rare communication data 202 corresponds to normal communication, the rare communication data 202 is also determined to be an attack.

[0147] In addition, although the case where each pattern is independent is described, a combination of several patterns may exist. As a specific example, it is considered that the following situation is very likely to occur: a certain communication is based on a command / response pattern, and the communication data 202 exchanged in the certain communication has regularity.

[0148] The style classification shown above is only an example, and thus, the possible styles of normal communication data 202 in the target system are various. Compared with the case where communication data 202 conforming to various styles are learned at once by one learning method, a model with higher accuracy can be learned by learning separately by a method suitable for each style. As a specific example, compared with the case where learning data is generated by mixing communication data 202 having completely different properties such as cyclically transmitted communication data 202 and instantaneously transmitted communication data 202, it is reasonable to generate two learning data without mixing two types of communication data 202. The key point of this embodiment is that, in order to learn a model with higher accuracy, style classification information 136 is generated in advance based on specification information 137, and an appropriate learning method can be selected according to each rule number based on the generated style classification information 136.

[0149] **Description of the effects of the second embodiment**

[0150] As described above, when the specification information 137 of the target system is obtained in advance, the communication patterns that may occur in the target system can be classified in advance to generate pattern classification information 136. Therefore, in this embodiment, a learning method selection unit 135 is provided to select a learning method using the pattern classification information 136. Thus, an appropriate learning method can be selected according to the communication pattern corresponding to the group, so the accuracy of attack detection based on learning can be improved.

[0151] Furthermore, according to the present embodiment, the learning method can be divided into different groups according to their patterns. Therefore, when implemented in a computer, the processing corresponding to each pattern can be assigned to a separate thread or CPU, etc., making it easy to execute the processing relatively efficiently.

[0152] Implementation method 3.

[0153] Hereinafter, points different from the above-described embodiment will be mainly described with reference to the drawings.

[0154] ***Structure description***

[0155] In the first and second embodiments, as the data structure of the permission list 122, the rules defining the characteristics of the communication data 202 considered normal are listed one by one, and it is assumed that each rule is given a unique identifier, but there is no specific regulation on the order of listing the rules. Therefore, as a method for retrieving the rules corresponding to the communication data 202 as the detection object, a method of confirming the rules one by one from the first rule is considered. In this method, the processing time increases in proportion to the number of rules, so this method is not suitable when the number of rules included in the permission list 122 is large. Therefore, as a data structure and retrieval method of the permission list 122 that is not affected by the number of rules, it is considered to use a hash table. In this embodiment, the hash table is effectively used in the permission list 122.

[0156] Fig.14 This is a diagram for explaining an example of a method of checking the permission list 122 using a hash table.

[0157] When checking the target data and each rule included in the permission list 122 , the attack detection unit 120 of the present embodiment checks the hash value corresponding to the target data and the value corresponding to each rule included in the permission list 122 .

[0158] The hash function 31 is designed to output a value greater than or equal to 1 and less than or equal to N (N is a positive integer) by performing calculations on an input value, and is designed so that the calculations can be performed at high speed.

[0159] The hash table 34 is designed to be accessible using a subscript greater than or equal to 1 and less than or equal to N. In particular, at a position accessed using the hash value 33 corresponding to the permitted communication data 202 as a subscript, a rule corresponding to the communication data 202 is stored.

[0160] exist Fig.14 In FIG. 1 , when communication data 202 is assigned, hash function 31 calculates 1 as hash value 33, and it is known that the index to be used for access is 1. Here, rule 35 is stored in hash table 34 as a rule corresponding to index 1. Therefore, it is known that communication data 202 is communication permitted by permission list 122.

[0161] On the other hand, when the hash value 33 corresponding to the communication data 202 is 2, there is no data corresponding to the subscript 2 in the hash table 34. Therefore, in this case, it can be known that the communication data 202 is unauthorized communication. In addition, based on the premise that the calculation of the hash function 31 is high-speed, the verification process using the hash table 34 can be performed at a high speed.

[0162] However, when searching for data using the hash table 34, it is necessary to consider the possibility that the hash values ​​33 for different inputs are identical. Fig.14 In the hash table 34 shown, there are two rules 36 corresponding to the subscript 3. This means that the hash values ​​33 corresponding to the communication data 202 corresponding to the two rules 36 are identical.

[0163] also, Fig.15 Another specific example of the consistency of hash values ​​33 for different inputs is shown. In this example, the hash value 33 of the permitted communication data 202 and the hash value 33 of the unpermitted communication data 202 are both 1, which is consistent. Here, the unpermitted communication data 202 should be determined as an attack, but the communication data 202 is mistakenly determined as permitted communication simply by confirming that there is a rule corresponding to subscript 1 in the hash table 34.

[0164] Therefore, when checking the communication data 202 with the permission list 122, it is necessary to first use the hash value 33 corresponding to the communication data 202 as a subscript to confirm that a rule exists in the hash table 34, and then confirm that the confirmed rule actually corresponds to the communication data 202. Thus, as a specific example, the checking unit 121 can finally determine that the communication data 202 is an attack by checking the rule 43 corresponding to the subscript 1 with the unauthorized communication data 202 and confirming that there is a mismatch.

[0165] In the hash table 34 described above, the index for accessing each rule is not unique, so the index cannot be learned as the rule number. Therefore, the data stored in the hash table 34 includes a unique rule number in addition to the rule.

[0166] As a specific example, Fig.16 In the hash table 34 shown in FIG. 1 , rule 51 and rule number 52 corresponding to rule 51 are stored for subscript 1. In addition, rule 53 and rule number 54 corresponding to rule 53 are stored for subscript 3. There are two rules corresponding to subscript 3, and a unique rule number is assigned to each rule. There are various methods for determining rule numbers, but in the example shown in FIG. 1 , rule numbers are determined by the rule number. Fig.16 In the example shown, a 10-bit integer is assigned as the rule number by setting the subscript K of the access hash table 34. Thus, if there are 10 or fewer rules with the same subscript, a unique rule number can be assigned to each rule.

[0167] Fig.17 A specific example of a packet generated in response to temperature data is shown. In this example, temperature data is represented in the payload part. In the case where application data or the like is represented in the payload part as in this example, the payload part changes according to the application data or the like, but most of the data other than the payload part is the same. In the case where the rules for permitting such communication data 202 are stored in the hash table 34, when rules are prepared according to each value that the communication data 202 can take, the data in the hash table 34 becomes huge, and therefore the efficiency decreases. Therefore, in the case of processing such communication data 202 in which application data or the like is represented in the payload part and the data other than the payload part does not change, the data other than the payload part is used as a rule, and each rule is assigned a unique rule number, and each rule assigned a unique rule number is managed in the hash table 34. In addition, the validity of the value of the payload part is verified by a method different from the method using the hash table 34. This different method is different from the method using the hash table 34. Fig.13 The data regularity is the same as shown in 25.

[0168] **Description of the effects of Embodiment 3**

[0169] As described above, according to this embodiment, even when the hash table 34 is used as the data structure and search method of the permission list 122, a unique rule number is given to each rule. In addition, according to this embodiment, for communication data 202 that represents application data or the like in the payload part, rules related to other than the payload part are generated. Therefore, the same learning as that described in Embodiments 1 and 2 can be applied to this embodiment.

[0170] ***Other implementation methods***

[0171] The above-described embodiments may be freely combined or arbitrary components of the embodiments may be modified, or arbitrary components may be omitted in the embodiments.

[0172] In addition, the embodiment is not limited to the contents described in Embodiments 1 to 3, and various changes can be made as needed. The process described using the flowchart and the like can also be appropriately changed.

[0173] Description of Reference Numerals

[0174] 100 attack detection device, 110 communication data acquisition unit, 120 attack detection unit, 121 verification unit, 122 permission list, 130 style determination unit, 131 model learning unit, 132 model storage unit, 133 determination unit, 134 model acquisition unit, 135 learning method selection unit, 136 style classification information, 137 specification information, 140 final determination unit, 141 determination synthesis unit, 150 determination result output unit, 21 cyclic transmission, 22 command / response, 23 number of restrictions, 24 instantaneous transmission, 25 data regularity, 26 rare communication, 202 communication data, 205 determination result, 206 rule number, 31 hash function, 33 hash value, 34 hash table, 35, 36, 43 rules, 302 rules, 303 determination result, 51, 53 rules, 52, 54 rule numbers, 501 grouping column, 502 rule number column, 503 number column, 504 chart, 902 processor, 903 main storage device, 904 auxiliary storage device, 905 data bus, 906 input interface, 907 display interface, 908 network interface, 909 processing circuit.

Claims

1. An attack detection device, in, The attack detection device comprises: an attack detection unit that performs attack detection processing in which a plurality of communication data are respectively used as target data and determines whether the target data complies with any rule included in a permission list, the permission list including a plurality of rules to which unique identifiers are respectively assigned; a pattern determination unit that, when the object data complies with any of the rules included in the permission list, performs a pattern determination process in which a model for determining whether an appearance pattern of an identifier corresponding to a rule followed by each of the plurality of communication data is normal is used to determine whether the identifier corresponding to the rule followed by the object data matches an appearance pattern of the identifier derived from the model; as well as A final determination unit determines whether the target data is normal using a determination result of the attack detection process and a determination result of the pattern determination process when the pattern determination process is executed.

2. The attack detection device according to claim 1, in, When it is determined in the attack detection process that the target data does not comply with any rule included in the permission list, the final determination unit determines that the target data is not normal, When it is determined in the attack detection process that the object data complies with any rule included in the permission list, and when it is determined in the style determination process that the identifier corresponding to the rule followed by the object data does not match the appearance style derived from the model, the final determination unit determines that the object data is abnormal.

3. The attack detection device according to claim 1 or 2, in, The pattern determination unit learns the model using a plurality of communication data determined to be normal and appearance patterns of identifiers respectively corresponding to the plurality of communication data determined to be normal.

4. The attack detection device according to claim 3, in, The pattern determination unit selects a method for learning the model based on classification of appearance patterns of identifiers corresponding to the plurality of communication data determined to be normal.

5. The attack detection device according to any one of claims 1 to 4, in, When checking the target data and each rule included in the permission list, the attack detection unit checks a hash value corresponding to the target data and a value corresponding to each rule included in the permission list.

6. An attack detection method, in, The computer performs attack detection processing in which a plurality of communication data are respectively used as object data, and it is determined whether the object data complies with any rule included in a permission list, the permission list including a plurality of rules to which unique identifiers are assigned respectively. The computer performs a pattern determination process in which, when the object data complies with any of the rules included in the permission list, a model for determining whether an appearance pattern of an identifier corresponding to a rule followed by each of the plurality of communication data is normal is used to determine whether the identifier corresponding to the rule followed by the object data matches the appearance pattern of the identifier derived from the model. When the computer executes the pattern determination process, the computer determines whether the target data is normal using a determination result of the attack detection process and a determination result of the pattern determination process.

7. An attack detection program, in, The attack detection program causes the attack detection device, which is a computer, to execute the following processing: an attack detection process in which a plurality of communication data are respectively used as target data, and it is determined whether the target data complies with any rule included in a permission list, the permission list including a plurality of rules to which unique identifiers are respectively assigned; a pattern determination process in which, when the object data complies with any of the rules included in the permission list, a model for determining whether the appearance pattern of the identifier corresponding to the rule followed by each of the plurality of communication data is normal is used to determine whether the identifier corresponding to the rule followed by the object data matches the appearance pattern of the identifier derived from the model; as well as The final determination process determines whether the target data is normal using the determination result of the attack detection process and the determination result of the pattern determination process when the pattern determination process is executed.

Images