Security monitoring device, security monitoring method, and program

Abstract

A security monitoring device according to one embodiment of the present disclosure is provided with: a reception unit that receives a first alarm that occurs when a threat is detected by a first security product, and a second alarm that occurs when a threat is detected by a second security product different from the first security product; a similarity calculation unit that calculates the similarity between the first alarm and the second alarm; and a first determination unit that determines, on the basis of the degree of similarity between the first alarm and the second alarm, whether or not the first alarm and the second alarm are alarms generated due to the detection of the same threat.

Description

Technical Field

[0001] The present disclosure relates to techniques for aggregating alerts generated by multiple security products. Background Art

[0002] Conventionally, the mainstream of intrusion detection systems (IDS) for detecting security attacks is a so-called signature-based IDS, which determines whether a specific pattern is included in an observed data flow.

[0003] However, as malware variants become easier to create and targeted attacks become more complex, the proportion of attacks that cannot be captured by signature-based IDS is increasing, and security monitoring parties are increasingly required to take different countermeasures.

[0004] One of the countermeasures is a software suite called UEBA (User and entity behavior analytics).

[0005] Unlike signature-based IDS, UEBA has attack detection models that capture a wide range of characteristics of commonly used attack methods, and UEBA uses each attack detection model to perform detection based on input log data. Each attack detection model not only checks the pattern within a single data like a signature-based IDS, but also determines whether multiple data included in a certain period meet specific conditions and performs detection.

[0006] Due to the nature of the attack detection model of UEBA, the range or conditions of the detected threats vary from product to product. Therefore, it is conceivable that a mechanism will be adopted in the future to detect a wider range of threats with high accuracy using multiple UEBAs. In this case, if multiple UEBA products detect the same threat and generate an alarm, the efficiency of the analysis can be improved by aggregating these alarms and analyzing them.

[0007] Patent Document 1 discloses a structure for extracting related alarms generated from the same security product by using a technique for aggregating the same threats detected by the security products.

[0008] Prior art literature

[0009] Patent Literature

[0010] Patent Document 1: Japanese Patent No. 6515048

[0011] Non-patent literature

[0012] Non-patent document 1: Alec Radford, et al., "Improving Language Understanding by Generative Pre-Training", Internet (https: / / s3-us-west-2.amazonaws.com / opennai-assets / research-covers / language-unsupervised / language_understand_paper.pdf) Summary of the invention

[0013] Problem that the invention aims to solve

[0014] However, due to the nature of UEBA, when multiple UEBAs generate alerts respectively, it is particularly difficult to determine whether each alert is generated due to the detection of the same threat.

[0015] In the configuration disclosed in Patent Document 1, it is possible to extract related alarms generated from the same security product, but it is not possible to determine whether multiple security products have generated alarms due to detection of the same threat.

[0016] Therefore, the present disclosure provides a security monitoring device or the like, which can determine, when a plurality of security products respectively generate alarms, whether these alarms are alarms generated due to detection of the same threat.

[0017] Means used to solve problems

[0018] A security monitoring device in one embodiment of the present invention comprises: a receiving unit, which receives a first alarm and a second alarm, wherein the first alarm is generated due to a threat detected by a first security product, and the second alarm is generated due to a threat detected by a second security product different from the first security product; a similarity calculation unit, which calculates the similarity between the first alarm and the second alarm; and a first determination unit, which determines whether the first alarm and the second alarm are alarms generated due to the detection of the same threat based on the similarity between the first alarm and the second alarm.

[0019] A security monitoring method according to one embodiment of the present invention receives a first alarm and a second alarm, wherein the first alarm is generated due to a first security product detecting a threat, and the second alarm is generated due to a second security product different from the first security product detecting a threat, the security monitoring method calculates the similarity between the first alarm and the second alarm, and based on the similarity between the first alarm and the second alarm, determines whether the first alarm and the second alarm are alarms generated due to the detection of the same threat.

[0020] A program according to one aspect of the present disclosure is a program for causing a computer to execute the above-mentioned security monitoring method.

[0021] Effects of the Invention

[0022] The security monitoring device or the like according to one embodiment of the present disclosure can determine whether alarms generated by a plurality of security products are alarms generated due to detection of the same threat. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a block diagram showing an example of the configuration of the safety system in the embodiment.

[0024] Figure 2 This is a block diagram showing an example of the configuration of the threat alert determination unit in the embodiment.

[0025] Figure 3A This is a block diagram showing an example of another configuration of the threat alert determination unit in the embodiment.

[0026] Figure 3B This is a block diagram showing an example of another configuration of the threat alert determination unit in the embodiment.

[0027] Figure 4 1 is a flowchart showing the same threat alarm determination process in the embodiment.

[0028] Figure 5 : is a flowchart showing the IDF learning process in the embodiment.

[0029] Figure 6 This is a flowchart showing a similarity calculation process using TF-IDF in the embodiment.

[0030] Figure 7 1 is a flowchart showing a similarity calculation process using a focus word in the embodiment.

[0031] Figure 8 It is a diagram showing an example of a focus word list in the embodiment.

[0032] Fig. 9 Detailed description of the invention is a flowchart showing the attack classification model learning process in the embodiment.

[0033] Fig.10 This is a diagram showing an example of classification of network attacks in the embodiment.

[0034] Fig.11 This is a diagram showing an example of threat intelligence information in an embodiment.

[0035] Fig.12 : is a flowchart showing a similarity calculation process using an attack classification model in the embodiment.

[0036] Fig.13 This is a diagram for explaining the calculation of the attack vector in the embodiment.

[0037] Fig.14 This is a flowchart showing a feature extraction process using detection information of past attacks in the embodiment.

[0038] Fig.15A This is a diagram for explaining an example of attack detection information in the embodiment.

[0039] Fig. 15B This is a diagram for explaining an example of the alarm generation timing of attack detection information in the embodiment.

[0040] Fig.16 1 is a flowchart showing a similarity calculation process using feature quantities in the embodiment.

[0041] Fig.17 This is a diagram for explaining a specific example of calculating the similarity of detection model descriptions used by security products using a large-scale language model in an embodiment. DETAILED DESCRIPTION

[0042] (A process of obtaining a method of the present disclosure)

[0043] With the development of malware's ability to evade detection and the emergence of many malware variants, today's IDS that relies solely on signatures often miss many threats. Therefore, security products such as UEBA that use defined threat behaviors for detection are gradually being adopted in many cases.

[0044] UEBA is equipped with a machine learning model (detection model), which has a mechanism to learn the normal behavior of each monitored device and quantify abnormal behavior and detect threats. Therefore, the threats detected by each security product are different.

[0045] The differences in the performance of security products mean that when multiple security products that use UEBA (multiple UEBA products) are introduced separately, the range of threats that can be detected can be expanded and the accuracy of the threats detected can be improved. In particular, when multiple UEBA products detect the same threat, it can be determined with high certainty that the threat has occurred.

[0046] However, a plurality of security products have different specifications in terms of input or output, respectively. Therefore, it is not easy to determine whether a plurality of alarms are alarms generated due to detection of the same threat.

[0047] Therefore, the inventors of the present application have repeatedly conducted in-depth research to solve this problem. In addition, the inventors of the present application have discovered a device that can determine whether these alarms are generated due to the detection of the same threat when multiple security products, such as UEBA, generate alarms respectively. Specifically, the inventors of the present application have discovered that when determining whether multiple alarms are generated due to the detection of the same threat, the description of the detection model used by each security product to detect the threat and / or the similarity of the past detection status of the detection model can be used. The description of the detection model is displayed (output) when each security product generates an alarm.

[0048] For example, in the description of the detection model of each security product, different terms are sometimes used for words with the same meaning. Or, even if the overall article structure of the description of the detection model is similar, there are sometimes detection models that want to detect significantly different attacks (threats). Therefore, the similarity between descriptions calculated using a general language model based on determining the similarity between detection models by the similarity of the descriptions of the detection models does not necessarily correspond to the similarity of the threats that the security product wants to detect.

[0049] Therefore, the present disclosure provides a security monitoring device and the like for solving these problems.

[0050] A security monitoring device in one embodiment of the present invention comprises: a receiving unit, which receives a first alarm and a second alarm, wherein the first alarm is generated due to a threat detected by a first security product, and the second alarm is generated due to a threat detected by a second security product different from the first security product; a similarity calculation unit, which calculates the similarity between the first alarm and the second alarm; and a first determination unit, which determines whether the first alarm and the second alarm are alarms generated due to the detection of the same threat based on the similarity between the first alarm and the second alarm.

[0051] According to the security monitoring device, when an alarm is generated by a security product group, the alarms that are considered to be generated by each security product due to detection of the same threat can be collected with high accuracy, thereby enabling efficient analysis of the same threat.

[0052] Hereinafter, a specific example of a safety monitoring device and a safety monitoring method according to one embodiment of the present disclosure will be described with reference to the accompanying drawings. The embodiments shown here all represent a specific example of the present disclosure. Therefore, the numerical values, shapes, constituent elements, configurations of constituent elements, and connection methods, as well as steps (processes) and the order of steps shown in the following embodiments are examples and do not limit the present disclosure. Among the constituent elements of the following embodiments, constituent elements not recorded in the independent technical solutions are constituent elements that can be added arbitrarily. In addition, each figure is a schematic diagram and is not necessarily a strict illustration.

[0053] (Implementation Method)

[0054] The following describes a security monitoring device and a security monitoring method of an embodiment. The security monitoring device and the security monitoring method of the embodiment perform identity determination processing on alarms generated by multiple security products. Specifically, the security monitoring device and the security monitoring method of the embodiment determine whether the alarms of multiple security products detect the same threat alarm.

[0055] [structure]

[0056] First, the configuration of a threat alarm identification unit as an example of a security monitoring device will be described.

[0057] Figure 1 It is a block diagram showing an example of the configuration of the security system 10 in this embodiment.

[0058] exist Figure 1 For example, the security system 10 is composed of a SIEM (Security Information and Event Management) 200, security products 300a and 300b, a L2SW (Layer 2Switch) 400, and a monitored network 500.

[0059] L2SW400 is a device with relay network function and has multiple mirror ports.

[0060] The monitoring target network 500 is a network that the security products 300a and 300b monitor. The monitoring target network 500 is connected to the L2SW 400. Frames (log data) flowing through the monitoring target network 500 are transmitted to the security products 300a and 300b via the L2SW 400.

[0061] The security products 300 a and 300 b are UEBA products that define threat behaviors and detect them. The security products 300 a and 300 b are respectively connected to the mirror port of the L2SW 400 , and acquire the log data output from the monitored network 500 via the L2SW 400 .

[0062] In addition, in the present embodiment, the security system 10 is described as including two security products, but this is just an example, and the security system 10 may include three or more security products.

[0063] The SIEM 200 is a system that is connected to the security products 300 a and 300 b in a communicable manner and acquires and manages and / or analyzes alarms output from the security products 300 a and 300 b. The SIEM 200 includes a threat alarm identification unit 100 .

[0064] The security products 300 a and 300 b respectively detect attacks (threats) using the acquired log data, and output an alarm to the SIEM 200 when an attack is detected.

[0065] The SIEM 200 inputs the acquired alarm to the threat alarm identification unit 100 and performs analysis using the output result thereof.

[0066] Next, the configuration of the security monitoring device according to the embodiment will be described.

[0067] <First example>

[0068] Figure 2 1 is a block diagram showing an example of the configuration of the threat alarm identification unit 100 in the present embodiment.

[0069] exist Figure 2 In the example, the same threat alarm determination unit 100 includes and is composed of a judgment target alarm acceptance unit 101, a same threat alarm candidate extraction unit 102, an obvious same threat alarm determination unit 103, an inter-alarm similarity calculation unit 105, an same threat alarm determination unit 104, a security document information acceptance unit 112, an IDF (Inverse Document Frequency) learning unit 113, and an IDF storage unit 114. Each processing unit such as the judgment target alarm acceptance unit 101, the same threat alarm candidate extraction unit 102, the obvious same threat alarm determination unit 103, the inter-alarm similarity calculation unit 105, the same threat alarm determination unit 104, the security document information acceptance unit 112, and the IDF learning unit 113 is realized by, for example, a processor and a memory such as a semiconductor memory storing a control program executed by the processor. The storage device such as the IDF storage unit 114 is realized by, for example, a HDD (Hard Disk Drive) or the like.

[0070] In addition, the same threat alarm determination unit 100 is an example of a security monitoring device. In addition, the judgment object alarm acceptance unit 101 is an example of an acceptance unit. The same threat alarm candidate extraction unit 102 is an example of an extraction unit. In addition, the obvious same threat alarm determination unit 103 is an example of a second determination unit. In addition, the same threat alarm determination unit 104 is an example of a first determination unit. In addition, the similarity calculation unit 105 between alarms is an example of a similarity calculation unit.

[0071] The determination target alarm accepting unit 101 accepts a determination target alarm 121 (also simply referred to as an alarm) from the security product 300 a or the security product 300 b . The determination target alarm accepting unit 101 notifies the accepted alarm to the same threat alarm candidate extracting unit 102 .

[0072] The judgment object alarm 121 is an alarm (information) about the threat detected by the security product 300a, 300b. For example, the alarm includes at least one of the time when the alarm is generated, the IP (Internet Protocol) address of the device detected as a threat (for example, the device under attack), and the detection model description, wherein the detection model description describes what kind of event (threat) the alarm detects. The detection model is a learning model that each of the security products 300a, 300b has and is used to detect threats. The detection model description is an article that describes the threats detected by the security product. Specifically, the detection model description is an article that describes the content of the threat when the security product 300a, 300b detects the threat using the detection model. The detection model description is, for example, "A device is repeatedly communicating with a external location with encrypted channel. There is a risk of the data being transmitted."

[0073] The identical threat alarm candidate extraction unit 102 narrows down the candidates of the alarms that need to be determined for identity (specifically, whether each alarm is generated due to detection of the identical threat) with respect to the notified alarms.

[0074] For example, the candidate conditions for identical alarms, i.e., alarms generated due to the detection of the same threat (also referred to as same threat alarms), are: the alarm notified from the security product 300a and the alarm notified from the security product 300b are generated within 60 minutes, and / or the IP address of the device detected as a threat is the same. The same threat alarm candidate extraction unit 102, for example, extracts alarms that meet such conditions as candidates for alarms (specifically, candidates for the same threat alarm). The conditions for narrowing down the candidates for the alarm are predefined, and the same threat alarm candidate extraction unit 102 extracts candidates for the same threat alarm based on the conditions. This condition is an example of a prescribed condition. In this way, the same threat alarm candidate extraction unit 102 extracts candidates for the alarm from the multiple alarms accepted by the determination object alarm acceptance unit 101 based on the prescribed conditions.

[0075] The same threat alarm candidate extraction unit 102 notifies the notified alarm and the alarm extracted as the candidate of the same threat alarm to the obvious same threat alarm determination unit 103. In addition, when there are more than three security products and the number of notified alarms and the alarm extracted as the candidate of the same threat alarm is plural, the same threat alarm candidate extraction unit 102 notifies the obvious same threat alarm determination unit 103 of the plurality of alarms including the notified alarm and the alarm extracted as the candidate of the same threat alarm as an alarm group.

[0076] The obvious identical threat alarm determining unit 103 determines whether the notified alarm and the alarm extracted as a candidate of the identical threat alarm are obviously identical threat alarms.

[0077] The obvious same threat alarm is an alarm that can be output when the same threat is obviously detected, for example, when the detection model of all security products (in this embodiment, security products 300a and security products 300b) that detect threats (attacks) is specifically used to detect specific malware. This information (product information) indicating which threat is detected by the detection model used by the security product to detect threats, such as detecting malware, can be pre-stored in the memory provided by the same threat alarm determination unit 100, or can be sent from the security products 300a and 300b to the same threat alarm determination unit 100. In this way, the obvious same threat alarm determination unit 103 determines whether each alarm is an alarm output due to the detection of the same threat based on the product information related to the security products 300a and 300b.

[0078] When it is determined that the notified alarm and the alarm extracted as a candidate of the same threat alarm are obviously the same threat alarm, the obvious same threat alarm determination unit 103 outputs the same threat alarm information 122. The same threat alarm information 122 is information indicating that each alarm is an alarm generated due to the detection of the same threat. For example, when it is determined that the alarm output (generated) by the security product 300a (alarm ID: a-0010) is the same as the alarm output (generated) by the security product 300b (alarm ID: b-0008), the obvious same threat alarm determination unit 103 outputs information represented in a list format such as (a-0010, b-0008) as the same threat alarm information 122. For example, the obvious same threat alarm determination unit 103 outputs this same threat alarm information 122 to the processing unit for analyzing threats provided by the SIEM 200.

[0079] If the notified alarm and the alarm extracted as the candidate of the same threat alarm are not determined to be obviously the same threat alarm, the obvious same threat alarm determining unit 103 notifies the notified alarm and the alarm extracted as the candidate of the same threat alarm to the inter-alarm similarity calculating unit 105 .

[0080] The inter-alarm similarity calculation unit 105 calculates the similarity between the notified alarms. Specifically, the inter-alarm similarity calculation unit 105 calculates the similarity between the alarms that are candidates extracted by the same threat alarm candidate extraction unit 102. More specifically, the inter-alarm similarity calculation unit 105 calculates the similarity between the alarms that are not determined as obvious same threat alarms by the obvious same threat alarm determination unit 103, and the alarms are candidates extracted by the same threat alarm candidate extraction unit 102. In this example, the inter-alarm similarity calculation unit 105 calculates the similarity between the alarms using the detection model description of the notified alarm and the detection model description of the alarm extracted as a candidate for the same threat alarm.

[0081] More specifically, the inter-alarm similarity calculation unit 105 extracts words from the detection model description of each alarm, and extracts IDF values, which are stored in the IDF storage unit 114 and associated with the extracted words.

[0082] The inter-alarm similarity calculation unit 105 calculates a TF-IDF (Term Frequency-Inverse Document Frequency) vector using the IDF value extracted from the detection model description (more specifically, the words extracted from the detection model description) for each alarm. The IDF value is extracted using document information (security document information) representing a security-related document. For example, the inter-alarm similarity calculation unit 105 calculates the similarity between each alarm based on the TF-IDF vector of each detection model description calculated using the IDF value of the word included in the document information.

[0083] The inter-alarm similarity calculation unit 105 calculates the cosine similarity between the TF-IDF vectors using the TF-IDF vector corresponding to the detection model description of each alarm.

[0084] The inter-alarm similarity calculation unit 105 notifies the calculated cosine similarity to the common threat alarm determination unit 104 .

[0085] The same threat alarm determination unit 104 determines whether each alarm is an alarm generated due to the detection of the same threat based on the similarity between each alarm. In this example, the same threat alarm determination unit 104 determines whether the notified alarm and the alarm extracted as a candidate of the same threat alarm are the same threat alarm by comparing the notified cosine similarity with a predefined threshold. In the case where the notified cosine similarity exceeds the predefined threshold, the same threat alarm determination unit 104 determines that the alarm is the same threat alarm and outputs the same threat alarm information 122. On the other hand, in the case where the notified cosine similarity is below the threshold, the same threat alarm determination unit 104 determines that it is not the same threat alarm. For example, in the case where the notified cosine similarity is below the threshold, the same threat alarm determination unit 104 does not output the same threat alarm information 122. For example, the same threat alarm determination unit 104 outputs the same threat alarm information 122 to the processing unit for analyzing threats provided by the SIEM 200. As a result, the threat is analyzed in the processing unit based on the same threat alarm information 122. For example, the analysis results are sent to a computer used by an administrator, and the administrator takes countermeasures against the threat based on the analysis results.

[0086] The IDF storage unit 114 learns the security document information 125 , and stores an IDF value as a result of learning the IDF of a word included in the security document information 125 .

[0087] IDF learning may be performed in advance in the same threat alarm determination unit 100, may be performed by the same threat alarm determination unit 100 when calculating similarities between alarms, or may not be performed in the same threat alarm determination unit 100. In this embodiment, the case of pre-learning in the same threat alarm determination unit 100 is described.

[0088] The security document information accepting unit 112 accepts the security document information 125. The security document information 125 is information indicating an article of a security blog published on the Internet, etc. The security document information accepting unit 112 notifies the IDF learning unit 113 of the accepted security document information 125.

[0089] The IDF learning unit 113 extracts words from the received security document information 125, clusters the extracted words, and maps them to cluster IDs. The IDF learning unit 113 learns IDF using the cluster IDs of the words in the received security document information 125, and obtains an IDF value. The IDF learning unit 113 causes the IDF storage unit 114 to store the IDF value obtained by learning.

[0090] <Second example>

[0091] Figure 3A1 is a diagram showing another example of the configuration of the threat alarm determination unit in the present embodiment. Note that the same reference numerals are given to the same configurations as the threat alarm determination unit 100 , and description thereof will be omitted.

[0092] exist Figure 3A In the example, the same threat alarm determination unit 1000 includes and is composed of a judgment target alarm acceptance unit 101, a same threat alarm candidate extraction unit 102, an obvious same threat alarm judgment unit 103, a same threat alarm judgment unit 104, an inter-alarm similarity calculation unit 205, a threat intelligence acceptance unit 109, an attack classification model learning unit 110, and an attack classification model storage unit 111. Each processing unit such as the inter-alarm similarity calculation unit 205, the threat intelligence acceptance unit 109, and the attack classification model learning unit 110 is implemented by, for example, a processor and a memory such as a semiconductor memory storing a control program executed by the processor. The attack classification model storage unit 111 is implemented by, for example, a HDD or the like.

[0093] The same threat alarm identification unit 1000 is an example of a security monitoring device. The inter-alarm similarity calculation unit 205 is an example of a similarity calculation unit.

[0094] The inter-alarm similarity calculation unit 205 calculates the similarity between the notified alarm and the alarm extracted as a candidate of the same threat alarm, using the attack classification model stored in the attack classification model storage unit 111 .

[0095] The attack classification model holding unit 111 holds an attack classification model learned using threat intelligence information 124, wherein the threat intelligence information 124 includes: classification information indicating the classification of network attacks (threats) (also called attack classification); and information of a document that is connected to each attack classification and describes an overview of the attack.

[0096] The attack classification model may be learned in advance in the same threat alarm determination unit 1000, or may be learned in the same threat alarm determination unit 1000 when calculating the similarity between alarms, or may not be learned in the same threat alarm determination unit 1000. In this embodiment, the case of learning in advance in the same threat alarm determination unit 1000 is described.

[0097] The threat intelligence receiving unit 109 receives threat intelligence information 124 including classification information and classification contents (summary of attacks). The threat intelligence receiving unit 109 notifies the attack classification model learning unit 110 of the received threat intelligence information 124 .

[0098] The attack classification model learning unit 110 learns the attack classification model using the threat intelligence information 124 including the received classification information and the content of the classification (summary of the attack). The attack classification model learning unit 110 stores the learned attack classification model in the attack classification model storage unit 111.

[0099] The alarm similarity calculation unit 205 inputs the detection model description included in each alarm into the attack classification model to obtain the attack vector (attack classification vector) of each detection model description. The alarm similarity calculation unit 205 calculates the similarity between each alarm based on the obtained attack vector.

[0100] As described above, in this example, the alarm similarity calculation unit 205 calculates the similarity between each alarm based on the attack vector, which is calculated using the attack classification model and indicates the degree of matching between the classification of threats described by each detection model, and the attack classification model is learned using the threat intelligence information 124, and the threat intelligence information 124 indicates the classification information indicating the classification of threats and the content of the classification. The details of the attack vector will be described later.

[0101] <Third Example>

[0102] Figure 3B 1 is a diagram showing an example of another configuration of the configuration of the threat alarm determination unit in the present embodiment. In addition, the same reference numerals are given to the same configuration as the threat alarm determination unit 100, and the description thereof is omitted.

[0103] exist Figure 3B In the example, the same threat alarm determination unit 2000 includes and is composed of a determination target alarm accepting unit 101, a same threat alarm candidate extraction unit 102, an obvious same threat alarm determination unit 103, a same threat alarm determination unit 104, an inter-alarm similarity calculation unit 305, a detection information accepting unit 106, a feature extraction unit 107, and a feature storage unit 108. Each processing unit such as the inter-alarm similarity calculation unit 305, the detection information accepting unit 106, and the feature extraction unit 107 is realized by, for example, a processor and a memory such as a semiconductor memory storing a control program executed by the processor. The storage device such as the feature storage unit 108 is realized by, for example, an HDD.

[0104] The same threat alarm identification unit 2000 is an example of a security monitoring device, and the inter-alarm similarity calculation unit 305 is an example of a similarity calculation unit.

[0105] The inter-alarm similarity calculation unit 305 calculates the similarity between the notified alarm and the alarm extracted as a candidate of the same threat alarm, using the feature quantity stored in the feature quantity storage unit 108 .

[0106] The feature storage unit 108 stores the feature of the security product 300a and the feature of the security product 300b extracted using the detection information 123 of attacks detected so far by the security product 300a and the detection information 123 of attacks detected so far by the security product 300b.

[0107] The feature extraction may be performed in advance in the same threat alarm determination unit 2000, may be performed in the same threat alarm determination unit 2000 when calculating the similarity between alarms, or may not be performed in the same threat alarm determination unit 2000. In this embodiment, the case of pre-extraction in the same threat alarm determination unit 2000 is described.

[0108] The detection information accepting unit 106 accepts the detection information 123 of attacks detected so far by the security product 300 a and the detection information 123 of attacks detected so far by the security product 300 b , and notifies the feature amount extracting unit 107 of the detection information 123 of attacks.

[0109] The feature amount extraction unit 107 extracts the feature amount of the notified attack detection information 123 , and stores the extracted feature amount in the feature amount storage unit 108 .

[0110] As described above, the alarm similarity calculation unit 305 calculates the similarity between the alarms using the feature extracted from the detection information (attack detection information 123) indicating the past threat detection results of the security products 300a and 300b. The details of the attack detection information 123 and the feature will be described later.

[0111] <Processing Order>

[0112] Next, a description will be given of a processing procedure of the threat alarm identification unit as an example of the security monitoring device.

[0113] <First example>

[0114] Figure 4 This is a flowchart of the same threat alarm determination process using the alarm of the same threat alarm identification unit 100 according to the embodiment.

[0115] First, the threat alarm identification unit 100 receives an alarm notified from the security products 300a and 300b (S1002).

[0116] Next, for the received alarm, the same threat alarm identification unit 100 extracts candidates of alarms similar to the alarm received this time, that is, candidates of the same threat alarm, from the alarms received in the past ( S1003 ).

[0117] Next, the identical threat alarm identification unit 100 determines whether there is an obviously similar alarm, that is, an obviously identical threat alarm, among the extracted alarm candidates ( S1004 ).

[0118] When it is determined that there is an obvious identical threat alarm ("Yes" in S1004), the identical threat alarm determination unit 100 extracts past alarms that are considered to be similar to the alarm currently input (i.e., accepted), and outputs identical threat alarm information 122, wherein the identical threat alarm information 122 indicates that the extracted past alarm and the accepted alarm are obviously the same threat alarm (S1007).

[0119] On the other hand, when it is determined that there is no obvious identical threat alarm ("No" in S1004), the identical threat alarm determination unit 100 calculates the similarity between the received alarm and the candidate identical threat alarm (S1005). The identical threat alarm determination unit 100 calculates the similarity using, for example, a description similarity calculation method based on TF-IDF. The details will be used Fig.11 To be described later.

[0120] Next, when the similarity between the received alarm and the candidate of the same threat alarm exceeds the threshold, the same threat alarm determination unit 100 outputs the same threat alarm information 122, which indicates that the received alarm and the candidate of the same threat alarm are similar alarms (i.e., the same threat alarm) (S1006). Here, for example, when the similarity between the received alarm and the candidate of the same threat alarm is below the threshold, the same threat alarm determination unit 100 does not output the same threat alarm information 122, and transfers the processing to step S1008.

[0121] After step S1006 or step S1007 , the threat alarm identification unit 100 checks whether there is another alarm that has not been determined among the received alarms ( S1008 ).

[0122] When there is another alarm (YES in S1008 ), the same threat alarm identification unit 100 performs the process of step S1002 .

[0123] On the other hand, when there is no other alarm (No in S1008 ), the same threat alarm identification unit 100 ends the process.

[0124] Figure 5 This is a flowchart of the IDF learning process according to this embodiment.

[0125] First, the secure document information accepting unit 112 accepts the secure document information 125 ( S1101 ).

[0126] Next, the IDF learning unit 113 extracts words from the security document information 125 and learns vector representation for the extracted words using Skipgram ( S1102 ).

[0127] Next, the IDF learning unit 113 sets an appropriate number of clusters K, clusters the learned word vector groups using the K-means method, and learns word clusters (S1103). The number of clusters K can be arbitrarily determined in advance and is not particularly limited.

[0128] Next, the IDF learning unit 113 stores word cluster information for mapping the learned words to the cluster IDs in the IDF storage unit 114 ( S1104 ).

[0129] Next, the IDF learning unit 113 converts each word of the security document information 125 into a cluster ID (word cluster ID) using the word cluster information held in the IDF holding unit 114 ( S1105 ).

[0130] Next, the IDF learning unit 113 learns the IDF of each word cluster using the entire received security document information 125 ( S1106 ).

[0131] Next, the IDF learning unit 113 stores the IDF (more specifically, the IDF value) obtained through learning in the IDF storage unit 114 ( S1107 ).

[0132] Figure 6 This is a flowchart of a similarity calculation process using TF-IDF by the same threat alarm identification unit 100 in the embodiment.

[0133] First, the inter-alarm similarity calculation unit 105 receives detection model descriptions of alarms notified from the security products 300 a and 300 b and detection model descriptions of alarms extracted as candidates for the same threat alarm ( S1201 ).

[0134] Next, the inter-alarm similarity calculation unit 105 converts each word described in each detection model into a cluster ID using the word cluster information stored in the IDF storage unit 114 ( S1202 ).

[0135] Next, the inter-alarm similarity calculation unit 105 calculates the TF-IDF vector of each detection model description using the IDF (IDF value) stored in the IDF storage unit 114 ( S1203 ).

[0136] Next, the alarm-to-alarm similarity calculation unit 105 calculates the cosine similarity between the TF-IDF vectors corresponding to the respective detection model descriptions, and calculates the similarity between the detection model descriptions ( S1204 ).

[0137] <Modification 1>

[0138] In addition, the inter-alarm similarity calculation unit 105 of the same threat alarm determination unit 100 uses the TF-IDF vector to calculate the similarity between the detection model descriptions, but the similarity can also be calculated using the focus words. For example, the same threat alarm determination unit 100 can be equipped with an inter-alarm similarity calculation unit that uses the focus words to calculate the similarity, instead of the inter-alarm similarity calculation unit 105.

[0139] Next, a case will be described in which the inter-alarm similarity calculation unit of Modification 1 calculates the similarity using the focus word instead of calculating the similarity by the inter-alarm similarity calculation unit 105. The inter-alarm similarity calculation unit of Modification 1 is an example of a similarity calculation unit.

[0140] Figure 7 This is a flowchart of a similarity calculation process using a focus word according to an embodiment.

[0141] First, the inter-alarm similarity calculation unit of Modification 1 receives detection model descriptions of alarms notified from the security products 300 a and 300 b and detection model descriptions of alarms extracted as candidates for the same threat alarm ( S1301 ).

[0142] Next, the inter-alarm similarity calculation unit of Modification 1 reads a predefined attention word list ( S1302 ).

[0143] Here, the focus word list is explained.

[0144] Figure 8 This is a diagram showing an example of a focus word list.

[0145] The focus word list includes information that lists specific words and word groups as focus words. Figure 8 In the search results, "internal", "external", "link / connection", "encrypt / ciper", "malware / virus / worm / trojan" and "command / service" are listed as focus words.

[0146] In addition, if Figure 8As shown, when the focus word is set in the form of "○○ / XX", it means the focus word "○○" or the focus word "XX".

[0147] return Figure 7 After step S1303, the similarity calculation unit between alarms of variant example 1 extracts a set (focus word set) of words appearing in the detection model description from the focus word list for each detection model description (S1303). Specifically, the similarity calculation unit between alarms of variant example 1 extracts the focus words included in the detection model description from the focus words included in the focus word list for each detection model description, thereby generating a focus word set including one or more extracted focus words.

[0148] Next, the alarm-to-alarm similarity calculation unit of Modification 1 calculates the similarity of each detection model description using the Jaccard coefficient for each focus word set extracted from each detection model description ( S1304 ).

[0149] As described above, the alarm similarity calculation unit of variant example 1 uses a predefined focus word list to extract focus words included in each detection model description, and calculates the similarity of one or more focus words extracted from each detection model description, i.e., a focus word set, thereby calculating the similarity between each alarm.

[0150] <Second example>

[0151] Fig. 9 : is a flowchart of the attack classification model learning process of the implementation method. Specifically, Fig. 9 10 is a flowchart showing a specific processing procedure of the threat alarm identification unit 1000 .

[0152] First, the threat intelligence receiving unit 109 receives threat intelligence information 124 indicating classification information indicating classification of network attacks (attack classification) and the content of the classification (document (threat intelligence) describing the classification) (S1401).

[0153] Here, the details of the threat intelligence information 124 are described.

[0154] Fig.10 This is a diagram showing an example of classification of network attacks in the embodiment.

[0155] Attack classification is information that roughly classifies various attack methods used by attackers. Attack classification can be generated, for example, using the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) MATRIX published by MITRE. In addition, the types of attacks included in the attack classification can be determined arbitrarily and are not particularly limited.

[0156] exist Fig.10 In the attack classification, "Port Scan", "IP Scan", "Brute Force", "Valid Account", "C&C Communication" and "Spoofing" are listed.

[0157] Fig.11 1 is a diagram showing an example of threat intelligence information 124 in this embodiment.

[0158] Threat intelligence information 124 is a set of groups of attack categories (classification information) associated with articles describing the summary of the attack. Fig.10 One or more attack categories among a plurality of attack categories included in the list of attack categories shown.

[0159] exist Fig.11 In the threat intelligence information 124, threat intelligence 1 and threat intelligence 2 are included. In threat intelligence 1, the summary of the attack shown in the article "A device tries to connect other devices repeatedly..." is associated with the attack categories "Port Scan" and "IP Scan". In threat intelligence 2, the summary of the attack shown in the article "Devices communicate with an external host at a certain rate using HTTPS to receive orders and send internal information..." is associated with the attack category "C&C Communication".

[0160] return Fig. 9After step S1401, the attack classification model learning unit 110 uses the threat intelligence information 124 and a language model such as BERT (Bidirectional Encoder Representations from Transformers) to learn an attack classification model (S1402).

[0161] Next, the attack classification model learning unit 110 stores the learned attack classification model in the attack classification model storage unit 111 ( S1403 ).

[0162] Fig.12 This is a flowchart of a similarity calculation process using an attack classification model in the embodiment.

[0163] First, the inter-alarm similarity calculation unit 205 receives detection model descriptions of alarms notified from the security products 300 a and 300 b and detection model descriptions of alarms extracted as candidates for the same threat alarm ( S1501 ).

[0164] Next, the inter-alarm similarity calculation unit 205 uses the attack classification model stored in the attack classification model storage unit 111 to obtain the attack vector described by each detection model ( S1502 ).

[0165] Fig.13 This is a diagram for explaining the calculation of the attack vector in the embodiment.

[0166] exist Fig.13 In the example, the alarm similarity calculation unit 205 uses the attack classification model to obtain the attack vector described by the detection model "A device is repeatedly communicating with an external location through an encrypted channel. There is a risk of the data being transmitted...". The attack vector is composed of Fig.10 The relative probabilities of the attack categories described in . Fig.13In the example shown, according to the detection model description, the attack classification probability for "Port Scan" is 0%, the probability for "IP Scan" is 0%, the probability for "BruteForce" is 2%, the probability for "Valid Account" is 3%, the probability for "C&C Communication" is 75%, and the probability for "Spoofing" is 0%. In addition, the attack vector in this example is (0, 0, 2, 3, 75, 0).

[0167] return Fig.12 After step S1502, the inter-alarm similarity calculation unit 205 calculates the similarity (specifically, cosine similarity) between the attack vectors described by the two detection models to be compared (S1503).

[0168] <Third Example>

[0169] Fig.14 This is a flowchart of a feature extraction process using the detection information 123 of past attacks in an embodiment. Specifically, Fig.14 1 is a flowchart showing a specific processing procedure of the threat alarm identification unit 2000 .

[0170] First, the detection information accepting unit 106 accepts the detection information 123 of the attacks detected so far by the security product 300 a and the detection information 123 of the attacks detected so far by the security product 300 b ( S1601 ).

[0171] Here, the details of the attack detection information 123 are described.

[0172] Fig.15A It is a diagram showing an example of the attack detection information 123 in this embodiment.

[0173] exist Fig.15A In the example, the attack detection information 123 includes the attack detection information detected by the security product 300a and the attack detection information detected by the security product 300b so far. Each of these attack detection information includes at least the distribution of the alarm generation time, the number of alarm generation times in the past week, and the number of detection object IPs in the past month.

[0174] Fig. 15B 1 is a diagram for explaining an example of the alarm generation time included in the attack detection information 123 in the embodiment. Specifically, Fig. 15B This is an example of the distribution of the alarm generation time included in the attack detection information 123 in the present embodiment, which is detected by the security product 300a so far.

[0175] exist Fig. 15B In the example shown, for example, the distribution of the alarm generation time of the detection information of the attacks detected so far by the security product 300a is: "0" at AM0, "0" at AM1, "0" at AM2, "0" at AM3, "0.01" at AM4, "0.02" at AM5, "0.05" at AM6, "0.07" at AM7, 0.07 at AM8, "0.07" at AM9, "0.08" at AM10, "0.08" at AM11, "0.08" at PM0, "0.07" at PM1, "0.05" at PM2, "0.05" at PM3, "0.05" at PM4, "0.05" at PM5, "0.03" at PM6, "0.02" at PM7, "0" at PM8, "0" at PM9, "0" at PM10, and "0" at PM11.

[0176] Return to Fig.15A , the number of alarms generated in the past week included in the detection information of attacks detected so far by the security product 300a is "120", and the number of detection target IPs in the past month is "25".

[0177] return Fig.14 After step S1601, the feature extraction unit 107 extracts the feature of the past attack detection information 123 (S1602). For example, the feature extraction unit 107 extracts the distribution of the alarm generation time, the number of alarm generation times in the past week, and the number of detection target IPs in the past month as feature quantities based on the attack detection information 123.

[0178] Next, the feature extraction unit 107 stores the extracted features in the feature storage unit 108 ( S1603 ).

[0179] Fig.16 This is a flowchart of similarity calculation processing using feature quantities in the embodiment.

[0180] First, the inter-alarm similarity calculation unit 305 receives detection model descriptions of alarms notified from the security products 300 a and 300 b and detection model descriptions of alarms extracted as candidates for the same threat alarm ( S1701 ).

[0181] Next, the inter-alarm similarity calculation unit 305 obtains a feature quantity corresponding to each detection model description from the plurality of feature quantities stored in the feature quantity storage unit 108 ( S1702 ).

[0182] Next, the inter-alarm similarity calculation unit 305 calculates the similarity between the feature quantities of the two alarms to be compared ( S1703 ).

[0183] <Modification 2>

[0184] In addition, the similarity calculation method is not limited to the similarity calculation method respectively performed by the inter-alarm similarity calculation units 105 , 205 , and 305 and the inter-alarm similarity calculation unit of Modification 1.

[0185] For example, the alarm similarity calculation unit may calculate the similarity between the detection model descriptions of each security product using a large language model (LLM).

[0186] Fig.17 This is a diagram for explaining a specific example of calculating the similarity between detection model descriptions used by security products using a large-scale language model in an embodiment.

[0187] like Fig.17 As shown, for example, the following method can be used: on the basis of explicitly giving two detection model descriptions and the similarity between their detection model descriptions to the large-scale language model, the similarity between the two detection model descriptions of the query object is obtained. The similarity calculation unit between alarms of variant example 2 uses such a method to calculate the similarity between each alarm. Specifically, the similarity calculation unit between alarms of variant example 2 inputs two detection model descriptions that become the target on the basis of giving an example of two detection model descriptions and the similarity between the two detection model descriptions to the large-scale language model, and obtains the similarity between the two detection model descriptions that become the target in response to the input. More specifically, the similarity calculation unit between alarms of variant example 2 inputs each detection model description included in the alarm generated from the security products 300a, 300b to the large-scale language model after learning using the two detection model descriptions and the similarity between the two detection model descriptions, obtains the similarity between the detection model descriptions output from the large-scale language model, and thereby calculates the similarity between each alarm. The similarity calculation unit between alarms of variant example 2 is an example of a similarity calculation unit.

[0188] In addition, as an example here, there may be multiple input detection model description pairs.

[0189] In addition, for example, the following method can be used: Fine tuning can be performed using training data to calculate the similarity between two detection model descriptions using the method disclosed in Figure 1 of the above-mentioned non-patent document 1. In other words, the large-scale language model used by the alarm similarity calculation unit of variant example 2 can be subjected to fine-tuning in machine learning.

[0190] (Effects, etc.)

[0191] Hereinafter, the techniques obtained from the disclosure of this specification are exemplified, and the effects etc. obtained from the exemplified techniques are described.

[0192] Technology 1 is a security monitoring device, which comprises: a receiving unit that receives a first alarm and a second alarm, wherein the first alarm is generated due to a first security product detecting a threat, and the second alarm is generated due to a second security product different from the first security product detecting a threat; a similarity calculation unit that calculates the similarity between the first alarm and the second alarm; and a first determination unit that determines, based on the similarity between the first alarm and the second alarm, whether the first alarm and the second alarm are alarms generated due to the detection of the same threat.

[0193] The first security product is, for example, security product 300a, and the second security product is, for example, security product 300b. The receiving unit is, for example, the judgment object alarm receiving unit 101. The similarity calculation unit is, for example, the similarity calculation unit between alarms (the similarity calculation unit between alarms 105, 205, or 305, etc.). The first judgment unit is, for example, the same threat alarm judgment unit 104. The security monitoring device is, for example, the same threat alarm determination unit (the same threat alarm determination unit 100, 1000, or 2000, etc.). The second alarm is, for example, an alarm detected by the second security product accepted by the receiving unit before the first alarm.

[0194] According to a security monitoring device in one embodiment of the present invention, based on the similarity of multiple alarms generated by multiple security products respectively detecting threats, it is possible to determine whether these alarms are alarms generated by detecting the same threat. Therefore, the security monitoring device can, for example, output information indicating whether multiple alarms are alarms generated by detecting the same threat to a device that analyzes the detected threats that cause multiple alarms. Thus, based on the information, the device can, for example, efficiently analyze the same threat, and thus can efficiently analyze the threats that cause multiple alarms. In other words, based on the information, the device can reduce the amount of processing involved in the analysis. Therefore, according to a security monitoring device in one embodiment of the present invention, it is possible to efficiently analyze the threats that cause multiple alarms.

[0195] Technology 2 is the security monitoring device described in Technology 1, wherein the first alarm includes a first detection model description that describes the threat detected by the first security product, and the second alarm includes a second detection model description that describes the threat detected by the second security product, and the similarity calculation unit calculates the similarity between the first alarm and the second alarm based on the TF (TermFrequency)-IDF vectors of the first detection model description and the second detection model description, respectively, and the TF-IDF vector is calculated using the IDF (Inverse Document Frequency) value of the word contained in the document information representing the security-related document.

[0196] The similarity calculation unit here is, for example, the inter-alarm similarity calculation unit 105 .

[0197] This makes it possible to calculate the similarities between a plurality of alarms with high accuracy.

[0198] Technology 3 is a security monitoring device described in Technology 1 or Technology 2, wherein the first alarm includes a first detection model description that describes the threat detected by the first security product, and the second alarm includes a second detection model description that describes the threat detected by the second security product. The similarity calculation unit uses a predefined focus word list to extract focus words included in the first detection model description and the second detection model description, and calculates the similarity between the first focus word set and the second focus word set, thereby calculating the similarity between the first alarm and the second alarm, wherein the first focus word set is one or more focus words extracted from the first detection model description, and the second focus word set is one or more focus words extracted from the second detection model description.

[0199] The similarity calculation unit here is, for example, the inter-alarm similarity calculation unit of Modification 1.

[0200] This makes it possible to calculate the similarities between a plurality of alarms with high accuracy.

[0201] Technology 4 is a security monitoring device described in any one of Technology 1 to Technology 3, wherein a first alarm includes a first detection model description describing a threat detected by a first security product, and a second alarm includes a second detection model description describing a threat detected by a second security product, and a similarity calculation unit calculates the similarity between the first alarm and the second alarm based on vectors of the first detection model description and the second detection model description, each of which represents a degree of match with a classification of the threat, wherein the vector is calculated using an attack classification model, and the attack classification model is a model learned using threat intelligence information, and the threat intelligence information shows classification information representing a classification of the threat and the content of the classification.

[0202] The similarity calculation unit here is, for example, the alarm similarity calculation unit 205. In addition, the vector referred to here is, for example, the above-mentioned attack vector.

[0203] This makes it possible to calculate the similarities between a plurality of alarms with high accuracy.

[0204] Technology 5 is a security monitoring device described in any one of Technology 1 to Technology 4, wherein the first alarm includes a first detection model description describing the threat detected by the first security product, and the second alarm includes a second detection model description describing the threat detected by the second security product, and the similarity calculation unit uses feature quantities extracted from the first detection information and the second detection information to calculate the similarity between the first detection model description and the second detection model description, thereby calculating the similarity between the first alarm and the second alarm, wherein the first detection information represents the detection results of past threats of the first security product, and the second detection information represents the detection results of past threats of the second security product.

[0205] The similarity calculation unit here is, for example, the inter-alarm similarity calculation unit 305 .

[0206] In this way, the similarity between multiple alarms can be easily calculated.

[0207] Technology 6 is a security monitoring device described in any one of technologies 1 to 5, further comprising a second determination unit that determines whether the first alarm and the second alarm are alarms generated due to detection of the same threat based on product information related to the first security product and the second security product.

[0208] The second determination unit is, for example, an obvious same-threat alarm determination unit 103. In addition, the product information is, for example, information indicating what kind of threat is detected by the detection model used by the security product to detect threats. For example, the product information is information indicating that malware, etc., is detected. For example, when the first security product and the second security product are both products that only detect malware, the second determination unit determines that the first alarm and the second alarm are alarms generated due to the detection of the same threat. On the other hand, for example, when the first security product and the second security product are at least one product that detects different threats, the second determination unit determines that the first alarm and the second alarm are not alarms generated due to the detection of the same threat. The determination result of the second determination unit is, for example, output to the first determination unit. The product information can be pre-stored in a memory possessed by the security monitoring device, or can be sent from the security product to the security monitoring device.

[0209] Thus, even if the number of alarms received by the receiving unit is huge, the second determination unit can determine whether the alarm is caused by detecting the same threat. Therefore, the number of alarms determined by the first determination unit can be reduced, thereby reducing the processing capacity of the security monitoring device.

[0210] Technology 7 is a security monitoring device described in any one of technologies 1 to 6, further comprising an extraction unit that extracts alarm candidates from multiple alarms received by the receiving unit based on specified conditions, and a similarity calculation unit that calculates the similarity between the first alarm and the second alarm that are the extracted candidates.

[0211] The extraction unit is, for example, the same threat alarm candidate extraction unit 102. The prescribed conditions are, for example, conditions for narrowing down the candidate range of the above alarms, such as the alarm notified from the security product 300a and the alarm notified from the security product 300a being generated within 60 minutes, and / or the IP address of the device detected as a threat is the same. The extraction unit outputs information indicating the extracted alarm candidates to, for example, the first determination unit and / or the second determination unit. For example, the first determination unit and / or the second determination unit, for example, performs the above determination on the alarm candidates extracted by the extraction unit.

[0212] As a result, the number of alarms determined by the first determination unit and / or the second determination unit can be reduced, thereby reducing the amount of processing of the security monitoring device.

[0213] Technology 8 is a security monitoring device described in any one of Technologies 1 to 6, wherein the first alarm includes a first detection model description that describes the threat detected by the first security product, and the second alarm includes a second detection model description that describes the threat detected by the second security product. The similarity calculation unit inputs the first detection model description and the second detection model description into a large-scale language model, and obtains the similarity between the first detection model description and the second detection model description output from the large-scale language model, thereby calculating the similarity between the first alarm and the second alarm, and the large-scale language model is learned using two detection model descriptions and the similarity between the two detection model descriptions.

[0214] The similarity calculation unit here is, for example, the inter-alarm similarity calculation unit 305 .

[0215] Thus, the similarity between multiple alarms can be easily calculated.

[0216] Technology 9 is the security monitoring device described in Technology 8, wherein a large-scale language model is implemented with fine-tuning in machine learning.

[0217] This makes it possible to calculate the similarities between a plurality of alarms with high accuracy.

[0218] Technology 10 is a security monitoring method, wherein a first alarm and a second alarm are received, wherein the first alarm is generated due to a first security product detecting a threat, and the second alarm is generated due to a second security product different from the first security product detecting a threat, and the security monitoring method calculates the similarity between the first alarm and the second alarm, and based on the similarity between the first alarm and the second alarm, determines whether the first alarm and the second alarm are alarms generated due to the detection of the same threat.

[0219] This achieves the same effects as the security monitoring device of one embodiment of the present disclosure.

[0220] Technique 11 is a program for causing a computer to execute the security monitoring method described in Technique 10 .

[0221] This achieves the same effects as the security monitoring device of one embodiment of the present disclosure.

[0222] (Replenish)

[0223] As described above, the embodiments are described as examples of the technology disclosed in the present application. However, the technology disclosed in the present application is not limited to these, and can also be applied to the embodiments in which appropriate changes, replacements, additions, omissions, etc. are made.

[0224] An example of a modification in the present disclosure is listed below.

[0225] (1) In the embodiments, the security product does not necessarily need to be a device that monitors only packet information input from the mirror port of the L2SW. For example, it may be a monitoring device that monitors logs of a firewall, a proxy, a general-purpose computer, or various manufacturing devices, and the type of log to be monitored is not limited.

[0226] (2) In the embodiment, a method of combining a method of calculating the similarity between detection model descriptions using TF-IDF, a method of calculating the description similarity using attack technology classification information, and a method of calculating the detection model similarity using an alarm generation tendency vector is described, but it is not necessary to use any one of them. For example, only one of the above similarity calculation methods may be used, or it may be combined with a method including a description similarity calculation method using a focus word. In addition, it is not necessary to use each similarity calculation method separately, and the vectors calculated by each method may be concatenated and regarded as one vector, and the similarity between the vectors generated thereby may be used.

[0227] (3) In the implementation mode, each component element in the security monitoring device can be individually integrated into a single chip by a semiconductor device such as IC (Integrated Circuit), LSI (Large Scale Integration), or a part or all of them can be integrated into a single chip. In addition, the method of circuit integration is not limited to LSI, and it can also be implemented using a dedicated circuit or a general-purpose processor. After the LSI is manufactured, a programmable FPGA (Field Programmable Gate Array) or a reconfigurable processor that can reconfigure the connection or setting of the circuit unit inside the LSI can be used. In addition, if a technology for replacing integrated circuits of LSI emerges due to advances in semiconductor technology or other derivative technologies, this technology can be used to integrate functional blocks. Applications in biotechnology, etc. are possible.

[0228] (4) The same threat alarm determination unit is implemented, for example, by a computer. The computer, for example, has a communication interface composed of a connector for connecting a communication line or a wireless communication circuit for communicating with various devices such as security products, a non-volatile memory for storing programs, a volatile memory as a temporary storage area for executing programs, a storage device for storing various information, an input and output port for sending and receiving signals, a processor for executing programs, etc. The computer can be implemented by a so-called microcomputer. The same threat alarm determination unit of the embodiment is, for example, an example of a security monitoring device.

[0229] (5) In the above embodiment, the processing executed by a specific processing unit such as the similarity calculation unit and the threat alarm determination unit may be executed by another processing unit. In addition, the order of multiple processing may be changed, and multiple processing may be executed in parallel.

[0230] (6) In the above-mentioned embodiments, each constituent element (each processing unit) can be implemented by executing a software program suitable for each constituent element. Each constituent element can be implemented by a program execution unit such as a CPU (central processing unit) or a processor reading out and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Each constituent element can be implemented by hardware. Each constituent element can be a circuit (or an integrated circuit). These circuits can constitute a circuit as a whole, or they can be separate circuits. In addition, each of these circuits can be a general circuit or a dedicated circuit.

[0231] (7) The general or specific aspects of the present disclosure may be implemented as a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM. For example, the present disclosure may be implemented as a program for a computer to execute a security monitoring method executed by a security monitoring device of an embodiment. In addition, the present disclosure may be implemented as any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

[0232] Availability in Industry

[0233] The present disclosure is useful for techniques to aggregate alerts generated from multiple security products.

[0234] Description of Reference Numerals

[0235] 10. Security System

[0236] 100, 1000, 2000 Same Threat Alert Determination Unit

[0237] 101 Judgment object alarm receiving unit

[0238] 102 Same Threat Alert Candidate Extraction Unit

[0239] 103 Obvious Same Threat Alarm Assessment Unit

[0240] 104 Same Threat Alarm Judgment Unit

[0241] 105, 205, 305 alarm similarity calculation unit

[0242] 106 Testing Information Receiving Department

[0243] 107 Feature extraction unit

[0244] 108 Feature quantity holding unit

[0245] 109 Threat Intelligence Receiving Department

[0246] 110 Attack Classification Model Learning Department

[0247] 111 Attack Classification Model Maintenance Unit

[0248] 112 Security Document Information Receiving Department

[0249] 113 IDF Learning Department

[0250] 114 IDF Maintenance Department

[0251] 121 Judgment object alarm

[0252] 122 Same threat alert information

[0253] 123 attack detection information

[0254] 124 Threat Intelligence Information

[0255] 125 Security File Information

[0256] 200 SIEM

[0257] 300a, 300b safety products

[0258] 400 L2SW

[0259] 500 Monitoring target network

Claims

1. A security monitoring device, wherein: have: An accepting unit, which accepts a first alarm and a second alarm, wherein the first alarm is generated because a first security product detects a threat, and the second alarm is generated because a second security product different from the first security product detects a threat; a similarity calculation unit, which calculates the similarity between the first alarm and the second alarm; as well as The first determination unit determines whether the first alarm and the second alarm are alarms generated due to detection of the same threat based on the similarity between the first alarm and the second alarm.

2. The security monitoring device according to claim 1, wherein: The first alert includes a first detection model description describing a threat detected by the first security product, The second alert includes a second detection model description describing a threat detected by the second security product, The similarity calculation unit calculates the similarity between the first alarm and the second alarm based on the respective TF-IDF vectors of the first detection model description and the second detection model description, wherein the TF-IDF vector is calculated using the IDF value of the words contained in the document information representing the security-related document, where IDF is the inverse document frequency and TF is the term frequency.

3. The security monitoring device according to claim 1, wherein: The first alert includes a first detection model description describing a threat detected by the first security product, The second alert includes a second detection model description describing a threat detected by the second security product, The similarity calculation unit uses a predefined focus word list to extract the focus words included in the first detection model description and the second detection model description, and calculates the similarity between the first focus word set and the second focus word set, thereby calculating the similarity between the first alarm and the second alarm. The first focus word set is one or more focus words extracted from the first detection model description, and the second focus word set is one or more focus words extracted from the second detection model description.

4. The security monitoring device according to claim 1, wherein: The first alert includes a first detection model description describing a threat detected by the first security product, The second alert includes a second detection model description describing a threat detected by the second security product, The similarity calculation unit calculates the similarity between the first alarm and the second alarm based on the vectors of the first detection model description and the second detection model description, each of which represents the degree of matching with the classification of the threat, wherein the vector is calculated using an attack classification model, and the attack classification model is a model learned using threat intelligence information, and the threat intelligence information shows classification information representing the classification of the threat and the content of the classification.

5. The security monitoring device according to claim 1, wherein: The first alert includes a first detection model description describing a threat detected by the first security product, The second alert includes a second detection model description describing a threat detected by the second security product, The similarity calculation unit uses feature quantities extracted from first detection information and second detection information to calculate the similarity between the first detection model description and the second detection model description, thereby calculating the similarity between the first alarm and the second alarm, wherein the first detection information represents the detection results of past threats of the first security product, and the second detection information represents the detection results of past threats of the second security product.

6. The security monitoring device according to any one of claims 1 to 5, wherein: The device further includes a second determination unit configured to determine, based on product information related to the first security product and the second security product, whether the first alarm and the second alarm are alarms generated due to detection of the same threat.

7. The security monitoring device according to claim 1, wherein: further comprising an extracting unit configured to extract candidates for alarms from the plurality of alarms received by the receiving unit based on a predetermined condition, The similarity calculation unit calculates a similarity between the first alarm and the second alarm which are extracted candidates.

8. The security monitoring device according to claim 1, wherein: The first alert includes a first detection model description describing a threat detected by the first security product, The second alert includes a second detection model description describing a threat detected by the second security product, The similarity calculation unit inputs the first detection model description and the second detection model description into a large-scale language model, and obtains the similarity between the first detection model description and the second detection model description output from the large-scale language model, thereby calculating the similarity between the first alarm and the second alarm. The large-scale language model is learned using two detection model descriptions and the similarity between the two detection model descriptions.

9. The security monitoring device according to claim 8, wherein: The large-scale language model is fine-tuned in machine learning.

10. A security monitoring method, wherein: accepting a first alarm and a second alarm, wherein the first alarm is generated due to a threat detected by a first security product, and the second alarm is generated due to a threat detected by a second security product different from the first security product, calculating the similarity between the first alarm and the second alarm, Based on the similarity between the first alarm and the second alarm, it is determined whether the first alarm and the second alarm are alarms generated due to detection of the same threat.

11. A procedure, The program is for causing a computer to execute the security monitoring method according to claim 10.

Images