Information processing method, information processing device, and program

Abstract

The information processing method according to one embodiment of the present disclosure includes: classifying a log of a device into any one of a plurality of groups based on a device state representing a state of the device controlled according to a command included in a communication packet; a low-slow attack is detected for each of the plurality of groups on the basis of one or more logs classified into each group.

Description

Technical Field

[0001] This disclosure relates to information processing methods, information processing apparatus, and procedures. Background Technology

[0002] Previously, there were devices for detecting anomalies in communications, such as network attacks (for example, see Patent Document 1).

[0003] Patent Document 1 discloses a system for detecting distributed denial-of-service (DDoS) attacks. Specifically, in the system disclosed in Patent Document 1, one or more requests for a service executed on a server are received from a first user, and a first vector corresponding to the first user is generated, containing multiple features representing the first user accessing the service. Furthermore, the system determines that the service has been subjected to a denial-of-service attack based on a comparison of the first vector with a baseline vector containing the average distribution of features from the multiple users accessing the service.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2019-21294 Summary of the Invention

[0007] The problem that the invention aims to solve

[0008] As a type of cyberattack, there exists the low and slow attack. It is hoped that low and slow attacks can also be detected.

[0009] This disclosure provides information processing methods, etc., capable of detecting slow and inefficient attacks.

[0010] Technical solutions for solving the problem

[0011] One technical solution disclosed herein relates to an information processing method comprising: classifying the device's logs into any one of a plurality of groups based on the device state representing the state of the device controlled according to the command contained in the communication packet; and detecting slow attacks based on one or more logs classified into each of the plurality of groups.

[0012] One technical solution disclosed herein relates to an information processing apparatus comprising: a classification unit that classifies logs of a device into any one of a plurality of groups based on a device state representing the state of a device controlled according to a command contained in a communication packet; and a detection unit that detects slow attacks based on one or more logs classified into each of the plurality of groups.

[0013] One technical solution disclosed herein relates to a program for causing a computer to execute the information processing method described above.

[0014] Invention Effects

[0015] According to this disclosure, information processing methods capable of detecting slow and low-speed attacks can be provided. Attached Figure Description

[0016] Figure 1 This is a diagram illustrating the configuration of the communication system involved in the implementation method.

[0017] Figure 2 This is a block diagram illustrating the functional structure of the home appliance server involved in the implementation method.

[0018] Figure 3 This is a diagram illustrating an example of an appliance log table involved in the implementation method.

[0019] Figure 4 This is a diagram illustrating an example of a communication log set table involved in the implementation method.

[0020] Figure 5 This is a diagram illustrating an example of an access information table involved in an implementation method.

[0021] Figure 6 This is a diagram illustrating an example of a log classification rule involved in the implementation method.

[0022] Figure 7 This is a diagram illustrating an example of an attack detection result table related to an implementation method.

[0023] Figure 8 It is a timing diagram showing the processing steps (processes) of the communication system involved in the implementation method.

[0024] Figure 9 This is a flowchart illustrating the processing steps of the home appliance server involved in the implementation method.

[0025] Figure 10 This is a flowchart illustrating the processing steps of detecting and handling slow attacks performed by the home appliance server involved in the implementation method.

[0026] Figure 11 This is a flowchart illustrating the information processing method involved in the implementation method. Detailed Implementation

[0027] (Insights that form the basis of this invention)

[0028] Previously, monitoring was conducted on servers (server devices) that collected logs from the authentication or operation of household electrical appliances (hereinafter referred to as home appliances) to ensure there were no abnormalities. For example, detection and defense were needed against network attacks such as slow attacks to prevent the server's structure from being leaked to the outside world.

[0029] Low-speed attacks are attacks aimed at paralyzing services, such as DoS attacks, or reconnaissance attacks (reconnaissance operations). A characteristic of low-speed attacks is that they involve attacks with relatively low traffic.

[0030] There are two types of slow attacks: slow Dos attacks and slow scan attacks.

[0031] A slow DoS attack refers to an attack that, during the communication connection process with a server, uses mechanisms such as retrying the communication connection to consume time in session establishment, thereby putting pressure on the communication connection with the server without increasing the traffic.

[0032] A slow scan attack refers to an attack that scans the target within the range of normal communication traffic. In a slow scan attack, to mimic normal communication, the daily traffic volume is small, but communication continues over a long period. The attack itself does not cause server malfunctions or other damage. However, because this is a reconnaissance attack, if the server's equipment configuration is leaked due to the attack, it could become clues for further attacks.

[0033] Furthermore, the communication content (e.g., communication packets) used in slow scanning attacks cannot be considered anomalous in themselves. Therefore, this type of attack has historically been difficult to detect.

[0034] To detect slow-attack attacks, one approach could be to observe the number and frequency of packets per day based on the IP (Internet Protocol) address of each sending source. In this method, for example, if signs of a slow-attack are observed over a long period, it is identified as such.

[0035] However, this method requires long-term observation of the communication, such as half a month. Furthermore, this method determines whether the communication constitutes a slow attack based on the IP address of each sending source. Therefore, during the observation period, each sending source needs to maintain a consistent IP address.

[0036] Here, there exists communication where the sending source is anonymous, such as a VPN (Virtual Private Network) connection (also referred to as anonymous communication). In anonymous communication, for example, a communication packet (also referred to as a packet) sent from the sending source is sent to the sending destination via a VPN server, etc. In anonymous communication, when a packet is sent via a VPN server, the IP address of the packet becomes the IP address of the VPN server. Therefore, from the perspective of the sending destination, the packet appears to have been sent from the VPN server, and thus the original IP address of the sending source becomes unknown.

[0037] Furthermore, when the VPN server used by the sending source changes, it appears as if the sending source's IP address has changed, making long-term IP address-based tracing difficult. Additionally, when the same VPN server is used by multiple sending sources, their IP addresses appear identical from the perspective of the destination, making it difficult to distinguish between them. When these sending sources cannot be distinguished, it appears as if a large amount of communication is occurring from the same source. Therefore, even assuming that one of the multiple sending sources is conducting a low-volume attack, it is difficult to detect the communication of that attack source as a low-volume attack.

[0038] To this end, the inventors of this application conducted in-depth research and found that logs of devices that serve as the destination for communication can be used to detect slow attacks.

[0039] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings.

[0040] Furthermore, the embodiments described below are either general or specific examples. The numerical values, shapes, materials, constituent elements, arrangement positions of constituent elements, connection methods, steps, and order of steps shown in the following embodiments are examples and are not intended to limit this disclosure. Additionally, constituent elements in the following embodiments not described in the independent claims of this disclosure are described as arbitrary constituent elements. Furthermore, the figures are not necessarily strictly illustrative. In the figures, substantially identical components are labeled with the same reference numerals, and sometimes repeated descriptions are omitted or simplified.

[0041] In addition, unless otherwise specified, in this specification, ordinal numbers such as "the first" and "the second" do not imply the quantity or order of the constituent elements, but are used for the purpose of differentiation to avoid confusion of the same constituent elements.

[0042] Furthermore, in this specification, for example, when described in comparison as "more than the threshold" or "below the threshold," it means that the threshold is used as a boundary for distinction, and may also mean "above the threshold" or "below the threshold," respectively.

[0043] (Implementation Method)

[0044] [constitute]

[0045] Figure 1 This is a diagram showing the configuration of the communication system 10 according to the implementation method.

[0046] The communication system 10 is a system for controlling home appliances such as air conditioning equipment 210, lighting equipment 220, and electric shutters (Venetian blinds) 230. The communication system 10 includes an appliance server 100, an indoor controller 200, an air conditioning unit 210, a lighting unit 220, an electric shutter 230, an anonymous communication server 300, and a domain name registration information server 400.

[0047] The home appliance server 100 is a computer that acquires and stores home appliance logs. The home appliance server 100 is communicatively connected via the Internet to a home controller 200, an anonymous communication server 300, and a domain name registration information server 400, all connected to a home network (i.e., a local network) used in a residence or similar facility. The home network is a communication network that allows the home controller 200 and home appliances to communicate wirelessly or via wired connections.

[0048] The home controller 200 monitors the device status of home appliances, and when the device status of the home appliance changes due to operation, it sends a log containing the changed device status, the device category indicating the type of the home appliance, the unique identifier of the home appliance (i.e., the device ID), and the operation command (also referred to as the command) used to operate the home appliance to the home appliance server 100 via the Internet.

[0049] The home controller 200 receives packets containing commands from sources such as smartphones or computers used by the user, and controls home appliances based on the commands contained in the received packets. The home controller 200 can receive packets directly from the source or via devices such as anonymous communication servers 300.

[0050] An anonymous communication server 300 forwards (transmits) packets received from a source to a destination computer in a manner that makes it impossible for the recipient to know that the packet originated from the source. In other words, the anonymous communication server 300 anonymizes the source of the packet and transmits it to the destination computer. For example, the anonymous communication server 300 uses its own IP address to send packets received from the source to the destination. Therefore, from the perspective of the computer receiving the packet, the source of the packet appears to be the anonymous communication server 300.

[0051] Domain name registration server 400 is a computer that stores registration information containing IP addresses and domain names associated with those IP addresses. Domain name registration server 400 is, for example, a server used for WHOIS (domain name lookup) services. Home appliance server 100, for example, determines whether a packet's IP address originated from anonymous communication server 300 by querying domain name registration server 400.

[0052] The home appliance server 100, the home controller 200, the anonymous communication server 300, and the domain name registration information server 400 are implemented through a communication interface for mutual communication, a non-volatile memory storing programs, a volatile memory serving as a transient storage area for executing programs, input / output ports for transmitting and receiving signals, and a processor for executing programs, respectively. This communication interface can be implemented, for example, through an antenna and wireless communication circuit capable of wireless communication, or through a connector for wired communication.

[0053] Furthermore, home appliances such as air conditioner 210, lighting fixture 220, and electric roller blind 230, which are communicatively connected to the home controller 200, are examples of such appliances. These could be any appliance, such as an electronic lock or a water heater. Additionally, the number of home appliances connected to the home network can be one or more. Air conditioner 210, lighting fixture 220, and electric roller blind 230 are examples of such devices. Home appliances communicatively connected to the home controller 200 could be, for example, IoT (Internet of Things) devices.

[0054] Furthermore, the communication standard used by the home controller 200 in communicating with these home appliances (i.e., the communication standard in the home network) can be arbitrary. The communication standard can be Wi-Fi (registered trademark), Bluetooth (registered trademark), or other communication standards. Additionally, these home appliances can also be controlled (operated) via the Internet.

[0055] Alternatively, the anonymous communication server 300 may be a server device that performs communication using a VPN connection, but it can be any device that can achieve anonymity by any means, as long as it can anonymize packets (i.e., make the IP address of the sending source unknown).

[0056] Figure 2 This is a block diagram illustrating the functional structure of the home appliance server 100 involved in the implementation method.

[0057] The home appliance server 100 includes an attack detection unit 110, a judgment unit 120, a communication unit 130, a display unit 140, and a storage unit 150.

[0058] Attack Detection Unit 110 is a processing unit that detects server attacks. Specifically, Attack Detection Unit 110 detects slow and weak attacks. Attack Detection Unit 110 is an example of a detection unit.

[0059] The determination unit 120 is a processing unit that classifies the logs of home appliances. Specifically, the determination unit 120 is a processing unit that classifies the logs of home appliances into any one of multiple groups based on the device status indicating the status of the home appliances controlled according to the commands contained in the packet. The packet is a packet sent to the home controller 200 for controlling home appliances such as air conditioner 210, lighting equipment 220, and electric roller blind 230. The determination unit 120 is an example of a classification unit.

[0060] In this embodiment, the determination unit 120 obtains the logs of the home appliance and, based on the device status (specifically, information indicating the device status) of the home appliance contained in the obtained logs, classifies the logs into any one of multiple communication log sets. Specifically, the determination unit 120 determines, based on the device status, whether there exists a set of logs (also called a communication log set) similar to the obtained logs of the home appliance, and classifies the logs by associating the logs with a communication log set ID. A communication log set is an example of a group.

[0061] For example, when the determination unit 120 receives a log from the home controller 200, it determines whether a log similar to the received log exists in the existing log set based on the device status contained in the received log. If the determination unit 120 determines that a log similar to the received log exists, it includes the received log in a communication log set that contains similar logs. For example, the determination unit 120 includes the received log in the same communication log set as a communication log set ID that includes similar logs by associating the received log with a communication log set ID. If the determination unit 120 determines that no log similar to the received log exists, it creates a new communication log set by associating the received log with a new communication log set ID.

[0062] For example, the determination unit 120 first categorizes the acquired appliance logs based on IP addresses. Additionally, the determination unit 120 determines whether the packets were sent via anonymous communication. That is, the determination unit 120, for example, determines whether the packets were sent via the anonymous communication server 300. For example, if the determination unit 120 determines that the packets were sent via anonymous communication, it further categorizes the appliance logs based on device status.

[0063] The attack detection unit 110 detects slow / low-speed attacks based on the logs of categorized home appliances. Specifically, the attack detection unit 110 detects slow / low-speed attacks based on at least one log entry categorized into each of multiple groups. In this embodiment, the attack detection unit 110 detects slow / low-speed attacks based on each communication log set, that is, each group categorized into the same group by the determination unit 120. Specifically, the attack detection unit 110 determines, for each communication log set, whether at least one log entry contained in the communication log set is a log entry of a home appliance controlled through communication aimed at a slow / low-speed attack. Thus, the attack detection unit 110 detects slow / low-speed attacks based on at least one log entry categorized into the same group for each group.

[0064] For example, in the detection (detection processing) of low-slow attacks, the attack detection unit 110 determines, for each of the multiple communication log sets, whether it is a low-slow attack, exhibits signs of a low-slow attack, or is not a low-slow attack, based on at least one log item categorized into each communication log set. For example, in the detection of low-slow attacks, the attack detection unit 110 detects low-slow attacks based on at least one of the following: the average daily number of visits to home appliances, the duration of visits to home appliances, and the frequency of visits to home appliances, calculated based on at least one log item categorized into each communication log set.

[0065] Furthermore, access to home appliances means sending packets for controlling the appliances. In this embodiment, the situation where the home controller 200 receives a packet containing commands for controlling the home appliances is also referred to as access to home appliances.

[0066] The date on which access to the home appliance begins refers to the initial date on which the home appliance was controlled in one or more logs classified into the same group, that is, in one or more logs associated with the same communication log set ID. In this embodiment, it is the date on which the home appliance was controlled based on commands contained in packets received by the home controller 200 in one or more logs classified into the same group.

[0067] Average number of visits refers to the value obtained by dividing the total number of visits from the date the appliance was first accessed until the date the average number of visits was calculated by the number of days (communication days) from the date the appliance was first accessed until the date the average number of visits was calculated.

[0068] Access duration days refers to the number of consecutive days that appliance control was performed in one or more logs categorized into the same group. Access duration days are calculated by adding the days on which appliances were accessed. In calculating access duration days, for example, if appliance control was performed on any given day, the access duration days up to the previous day are incremented by 1; otherwise, no increment is made. Furthermore, in calculating access duration days, for example, if no appliance control was performed in one or more logs categorized into the same group during a second period of one month, the access duration days are set to 0. In calculating access duration days, for example, if the access duration days up to the previous day were 2, and appliance control was performed on the day the access duration days are being calculated, the access duration days are set to 3. Conversely, in calculating access duration days, for example, if the access duration days up to the previous day were 2, and appliance control was not performed on the day the access duration days are being calculated, the access duration days remain unchanged at 2. In addition, in the calculation of access duration days, for example, if the access duration days up to 1 month is 10, if no appliance control was performed from 1 month ago until the day the access duration days are calculated, the access duration days will be set to 0.

[0069] Access frequency refers to the frequency of appliance control execution within one or more logs categorized into the same group. Access frequency is calculated, for example, as follows: If appliance control was performed on any given day, the access frequency up to the previous day is incremented by 1; otherwise, no increment is made. Furthermore, in the access frequency calculation, for example, during a period of 3 days, if no appliance control was performed within one or more logs categorized into the same group, the calculated access frequency is decremented by 1. For example, if the access frequency up to the previous day was 2, and appliance control was performed on the day the access frequency is calculated, the access frequency is set to 3. Conversely, if the access frequency up to the previous day was 2, and no appliance control was performed on the day the access frequency is calculated, the access frequency remains unchanged at 2. Additionally, for example, if the access frequency up to 3 days ago was 2, and no appliance control was performed from 3 days ago until the day the access frequency was calculated, then the access frequency is set to 1.

[0070] Furthermore, the values ​​used for the aforementioned addition or subtraction operations, the first period, and the second period are examples and can be arbitrarily determined. For example, the second period can be set to be longer than the first period by a number of days.

[0071] For example, in detecting slow and low-speed attacks, the attack detection unit 110 determines that it is not a slow and low-speed attack if the average number of accesses is higher than the first threshold. Alternatively, for example, in detecting slow and low-speed attacks, the attack detection unit 110 determines that it is not a slow and low-speed attack if the number of access durations is lower than the second threshold.

[0072] On the other hand, for example, in detecting slow and low-speed attacks, the attack detection unit 110 determines that it is a slow and low-speed attack or has signs of such an attack if the average number of visits is below a first threshold and the number of days the visits last is longer than a second threshold. For example, in detecting slow and low-speed attacks, the attack detection unit 110 determines that it is a slow and low-speed attack if the frequency of visits is higher than a third threshold. On the other hand, for example, the attack detection unit 110 determines that it has signs of a slow and low-speed attack if the number of days the visits last is below a third threshold.

[0073] Furthermore, the first threshold, the second threshold, and the third threshold can be determined arbitrarily without any particular limitation.

[0074] Each processing unit, such as the attack detection unit 110 and the determination unit 120, is implemented, for example, by a memory and a processor, such as a CPU (Central Processing Unit), that executes a control program stored in the memory. The memory for these processing units can be implemented using a common memory or by using one or more independent memories. Furthermore, the processor for these processing units can be implemented by a common processor for each processing unit or by one or more independent processors for each processing unit.

[0075] The communication unit 130 is a communication interface used to communicate with the home controller 200, the anonymous communication server 300, and the domain name registration information server 400. The communication unit 130 can be implemented, for example, by means of an antenna and a wireless communication circuit capable of wireless communication, or by means of a connector for connecting a communication line.

[0076] Display unit 140 is a display for displaying images. For example, display unit 140 displays the detection results of attack detection unit 110.

[0077] Storage unit 150 is a storage device for storing various types of information. Storage unit 150 may be implemented using a storage device such as semiconductor memory or HDD (Hard Disc Drive). Storage unit 150 may store, for example, the aforementioned thresholds and appliance logs. For instance, storage unit 150 may store appliance log tables, communication log sets, access information tables, information indicating log classification rules, and attack detection result tables, as described later. Storage unit 150 may also store the IP address and / or domain name of anonymous communication server 300.

[0078] [Specific examples]

[0079] Next, specific examples of various types of information will be provided.

[0080] Figure 3 This is a diagram illustrating an example of an appliance log table involved in the implementation method.

[0081] The home appliance log table contains information about the logs of home appliances sent from the home controller 200 to the home appliance server 100. The determination unit 120 creates or updates the home appliance log table, for example, when it receives logs via the communication unit 130. For example, whenever the device status of a home appliance changes, the home controller 200 sends a log to the home appliance server 100. For instance, when a home appliance performs a device status change, it sends a log containing the device status to the home controller 200. The home controller 200 then sends the received log containing the device status to the home appliance server 100.

[0082] Logs sent from the home controller 200 to the appliance server 100 include information such as timestamps, source IP addresses, device types, device IDs, URIs (Uniform Resource Identifiers), queries, and device status. The appliance log table contains, for example, this information from the logs, as well as information indicating the presence or absence of anonymous communication. Figure 3 (The "anonymous communication" shown).

[0083] A timestamp is information indicating the date and time when an appliance was controlled to a device state associated with that timestamp.

[0084] Source IP is information that indicates the IP address of the source of the packet containing the command used to control the appliance to make it the device state associated with that source IP.

[0085] Device category is information indicating the category of the controlled home appliances.

[0086] Device ID is information that uniquely identifies the controlled home appliance.

[0087] A URI is information that represents an identifier used to identify logs sent from the home controller 200 to the appliance server 100.

[0088] A query is information about the variables assigned to a URI.

[0089] Device status refers to the state of a home appliance after it has been controlled; in other words, it is information about the control content of the home appliance.

[0090] Information indicating the presence or absence of anonymous communication indicates whether a packet containing commands for controlling home appliances was sent via anonymous communication. For example, the determination unit 120 communicates with the domain name registration information server 400 via the communication unit 130 to inquire whether the source IP address is the IP address of the anonymous communication server 300. Based on the communication result, the determination unit 120 determines whether the source IP address was sent via anonymous communication, that is, whether the source IP address is the IP address of the anonymous communication server 300. Furthermore, the determination unit 120 instructs the storage unit 150 to store the determination result in the home appliance log table. Figure 3 In the example shown, when "Anonymous Communication" is "None," it means the source IP address is not the IP address of the anonymous communication server 300. On the other hand, in Figure 3 In the example shown, when "Anonymous Communication" is "Yes", it means that the source IP is the IP address of the anonymous communication server 300.

[0091] Figure 4 This is a diagram illustrating an example of a communication log set table involved in the implementation method.

[0092] The communication log set table represents information about the communication log set ID associated with each log. In other words, the communication log set table represents information about groups of similar logs. A communication log set is, for example, a collection of logs acquired within a predetermined period (e.g., one day). The determination unit 120 assigns a communication log set ID to each log for management. The communication log set ID is used as identification information when managing information about slow attacks in the access information table described later. Device information recorded in each communication log set is used to distinguish the sending source in cases where anonymous communication is used during access to home appliances. For example, for access using anonymous communication, the determination unit 120 distinguishes the sending source based on the device status of the home appliance and determines the communication log set used to detect slow attacks.

[0093] Furthermore, the scheduled period can be arbitrarily determined as one week or one month, etc.

[0094] The determination unit 120 creates or updates a communication log set table, for example, based on an appliance log table. For instance, the determination unit 120 categorizes the logs contained in the appliance log table by their source IP address. Furthermore, when anonymous communication is "present," the determination unit 120 further categorizes the logs categorized by source IP address by device category. Additionally, the determination unit 120 further categorizes the logs categorized by device category by device ID. Furthermore, the determination unit 120 further categorizes the logs categorized by device ID by device status. Specific examples of the classification methods will be described later.

[0095] In addition, the determination unit 120 can classify logs with "none" anonymous communication by device type, device ID, and device status, or it can choose not to classify them.

[0096] In addition, the determination unit 120 calculates the average number of accesses, access frequency, access duration days, and total number of accesses based on the communication log set table and for each log associated with the same communication log set ID.

[0097] Figure 5 This is a diagram illustrating an example of an access information table involved in an implementation method.

[0098] The access information table contains information for each communication log set, including the last access date, total number of accesses, access duration in days, average number of accesses, and access frequency (also known as access information).

[0099] The final access date refers to the last day that the appliance was controlled within one or more logs associated with the same communication log set ID; that is, the last day there was any access to the appliance. For example, in the detection and processing of low-speed attacks, the final access date is used to calculate the number of days elapsed since the last access date (the access date preceding the latest access date) when calculating access frequency. When the determination unit 120 detects new access to the appliance, it updates the final access date in the access information table. The determination unit 120 creates or updates the access information table based on the communication log set table.

[0100] The determination unit 120, for example, at the end of a day (e.g., between 11 PM and midnight), associates the logs received that day with the communication log set ID and calculates the average number of accesses, access frequency, access duration in days, and total number of accesses. Furthermore, the determination unit 120 uses the calculation results to update the access information table.

[0101] For example, the determination unit 120 updates the access duration in the access information table by adding a value of 1 to each day that a home appliance is accessed.

[0102] The "Average Number of Accesses" field in the access information table stores the average number of accesses up to the last access date. For example, in the detection and processing of slow attacks, the determination unit 120 refers to the average number of accesses in the access information table when recalculating the average number of accesses and updates the average number of accesses.

[0103] The access information table stores the access frequency up to the last access date in the "Access Frequency" field. For example, in the detection and processing of low-speed attacks, the determination unit 120 refers to the access frequency when recalculating the access frequency and updates the access frequency accordingly.

[0104] The "Total Access Count" field in the access information table stores the cumulative value of access counts from the initial access date (in other words, the date the communication log set was created). The determination unit 120 resets the total access count value (that is, sets the value to 0) in cases where there has been no access to the home appliance for an extended period, such as one month.

[0105] Figure 6 This is a diagram illustrating an example of the log classification rules involved in the implementation method.

[0106] The log classification rule is the rule used by the determination unit 120 to classify logs. That is, the log classification rule is the rule that associates logs with communication log set IDs. For example, based on the log classification rule, the determination unit 120 classifies (divides) the acquired multiple logs into any one of multiple communication log sets. The log classification rule is used to distinguish between low-speed attack communications and legitimate communications based on the device status, targeting access to home appliances that utilizes anonymous communication. The log classification rule is associated with device categories and is set according to the characteristics of each home appliance. Figure 6 Information such as the log classification rules corresponding to the device category, as shown, is pre-created and stored in storage unit 150.

[0107] Logs are categorized using log classification rules by associating logs with similar device states with the same communication log set ID. Figure 6 In the example shown, when the device category is "lighting device," the device status (or the command used to set the device to that status) represents, for example, an ON (lit) state or an OFF (off) state. In this example, when the device category is "lighting device," the determination unit 120 classifies the logs by associating different communication log set IDs based on whether the ON or OFF status indicated by the log's device status is the same as or different from the device status of the previous log. That is, for example, the determination unit 120 classifies each log into logs indicating that control was performed consecutively to set the same device status, and logs indicating that control was performed by changing the device status.

[0108] Furthermore, when the device category is "electronic lock," the device status may indicate, for example, a locked state or an unlocked state. Similarly, when the device category is "motorized roller blind," the device status may indicate, for example, an open state or a closed state. In this example, the determination unit 120, in the case of "electronic lock" or "motorized roller blind," similarly classifies each log into logs indicating continuous control of the same device status and logs indicating control performed by changing the device status, in the case of "lighting equipment."

[0109] In this example, when the device category is "air conditioning equipment" or "water heater," the device status indicates temperature (specifically, room temperature or water temperature). In this example, when the device category is "air conditioning equipment" or "water heater," the determination unit 120 categorizes the logs according to each temperature indicated by the device status. For example, when the determination unit 120 obtains a first log entry (e.g., a log associated with a new communication log set ID) for the device category "air conditioning equipment" or "water heater," it uses the first temperature indicated by the device status in the first log entry as a basis and categorizes the second log entry based on whether the second temperature indicating the device status in a second log entry obtained after the first log entry is more than a predetermined temperature away from the first temperature. For example, if the second temperature is more than a predetermined temperature away, the determination unit 120 associates the first log entry and the second log entry with different communication log set IDs. On the other hand, for example, if the second temperature is not more than a predetermined temperature away, the determination unit 120 associates the first log entry and the second log entry with the same communication log set ID.

[0110] Furthermore, the preset temperature can be set arbitrarily without any particular restrictions.

[0111] Furthermore, when the device status can take multiple values, such as room temperature or water temperature, it is possible to predetermine whether to set it to the same temperature range for the same device status. For example, when the device status is temperature, it can be predetermined as various temperature ranges such as below 10°C, above 10°C and below 15°C, above 15°C and below 20°C, and above 20°C. For example, the determination unit 120 associates the logs representing device statuses within the same temperature range with the same communication log set ID.

[0112] Additionally, for example, if the device category is "lighting equipment", the determination unit 120 can also classify the logs as either "on" or "off".

[0113] Furthermore, the relationship between device category and device status does not necessarily have to be one-to-one. For example, when the device category is "air conditioning equipment," the device status may represent not only temperature, but also ON or OFF status, airflow, and airflow direction. Log classification rules can also be determined based on each of these device statuses.

[0114] Figure 7 This is a diagram illustrating an example of an attack detection result table related to an implementation method.

[0115] The attack detection result table contains information about the judgment results (detection results) obtained by the attack detection unit 110 in performing a low-slow attack judgment on each log associated with the same communication log set ID. The attack detection result table includes at least the communication log set ID, the access date, and information indicating the judgment result. Figure 7 In the example shown, the attack detection result table includes the communication log set ID, access date (the date of access), source IP address, presence or absence of anonymous communication, and information indicating the judgment result. The judgment result stores the judgment result obtained during the low-speed attack detection process for communication on the date indicated by the access date. For example, at the end of the day, the attack detection unit 110 performs low-speed attack detection processing on logs associated with the same communication log set ID as the logs obtained that day.

[0116] Figure 7 The "Access Date" shown indicates the last date and time when the log associated with the corresponding communication log set ID was retrieved. That is, in this example, the "Access Date" represents the last day on which the log associated with the corresponding communication log set ID underwent detection processing for slow attack.

[0117] Figure 7 The "Judgment Result" shown indicates the detection result of a low-speed attack detected by the attack detection unit 110. A judgment result of "Normal" indicates that the attack detection unit 110's detection result is "not a low-speed attack". A judgment result of "Signs Present" indicates that the attack detection unit 110's detection result is "showing signs of a low-speed attack". A judgment result of "Attack" indicates that the attack detection unit 110's detection result is "a low-speed attack".

[0118] The determination result can be notified to the user, for example, by displaying it on the display unit 140. Alternatively, the determination result can be displayed on the display unit 140 only if the determination result contains the word "attack".

[0119] [Processing Steps]

[0120] Next, the processing steps in the communication system 10 will be explained.

[0121] Figure 8 This is a timing diagram illustrating the processing steps of the communication system 10 according to the implementation method. Specifically, Figure 8 This is a timing diagram illustrating the process by which the attack detection unit 110 detects a slow attack when anonymous communication is used in communication to control home appliances communicatively connected to the home controller 200. Furthermore, in Figure 8 The illustrations of the home appliances and anonymous communication server 300 provided by the communication system 10 are omitted.

[0122] When the home controller 200 receives a packet containing a command, it executes control of the home appliance corresponding to the command. Additionally, the home controller 200 sends the home appliance's log (communication log) to the home appliance server 100 (S110). For example, the home controller 200 sends the home appliance's log to the home appliance server 100 when the home appliance's status changes.

[0123] The home appliance server 100 queries for source information, which is information related to a source having an IP address represented by the source IP contained in the received log (S120). For example, the home appliance server 100 sends the information representing the IP address of the source IP contained in the received log to the domain name registration information server 400.

[0124] When the domain name registration information server 400 receives an inquiry about the source of information from the home appliance server 100, it notifies (i.e. sends) the source of information corresponding to the IP address being inquired about to the home appliance server 100 (S130). For example, the domain name registration information server 400 sends the source of information corresponding to the IP address represented by the received information to the home appliance server 100.

[0125] The source information sent is, for example, information indicating whether the communication device whose IP address is being queried by the domain name registration information server 400 is an anonymous communication server 300.

[0126] In steps S120 and S130, the home appliance server 100 communicates with the domain name registration information server 400 to obtain information indicating whether the source of the IP address represented by the source IP contained in the received log is the anonymous communication server 300.

[0127] Next, the home appliance server 100 searches for communication log sets similar to the received logs (S140). Specifically, the home appliance server 100 associates the received logs with a communication log set ID based on log classification rules, etc.

[0128] Next, the home appliance server 100 detects slow attacks based on the communication log set (S150). As described above, for example, the home appliance server 100 uses the communication log set table to search for communication log sets containing logs similar to the received logs, and if a communication log set containing similar logs is found, it performs slow attack detection processing on that communication log set.

[0129] also, Figure 8Each of the processes shown can be executed each time a log is retrieved, or it can be executed at a predetermined time, such as at the end of a day. For example, the home controller 200 can send a log indicating the execution result of a process to the home appliance server 100 each time it causes a home appliance to perform a process corresponding to a command, or it can send more than one log to the home appliance server 100 at a predetermined time. In addition, the home appliance server 100 can execute the processes of steps S120 to S160 each time a log is received, or it can execute the processes of steps S120 to S160 at a predetermined time based on more than one log.

[0130] Each scheduled time can be determined arbitrarily, without any special restrictions.

[0131] Figure 9 This is a flowchart illustrating the processing steps of the home appliance server 100 according to the implementation method. Specifically, Figure 9 This indicates that the decision unit 120 performs the following actions. Figure 8 A flowchart detailing step S140 is shown. For example, Figure 9 The flowchart shown is, for example, conceived of being performed in batches, or in any period such as one day.

[0132] First, the determination unit 120 obtains the source information based on the source IP address contained in the received log (S210). Specifically, the source information is obtained by performing steps S120 and S130.

[0133] Next, the determination unit 120 determines, based on the source information, whether the access to the home appliance for making the home appliance the device state represented by the received log is anonymous communication (S220). Specifically, the determination unit 120 determines whether the packet containing the command to control the home appliance to make it the device state represented by the received log is a packet sent via anonymous communication.

[0134] Next, if the determination unit 120 determines that it is anonymous communication (S220: Yes), that is, if it determines that the packet is sent through anonymous communication, it extracts the log that matches the device ID contained in the received log from the communication log set table (S230).

[0135] Next, the determination unit 120 classifies the received logs based on the device status of the home appliance represented by the device ID (S250). Specifically, first, the determination unit 120 determines whether there exists a communication log set (also referred to as a similar communication log set) containing logs similar to the received logs (S250). More specifically, the determination unit 120 determines whether there are logs in the logs extracted in step S230 containing device statuses similar to those in the received logs. Whether the logs are similar is determined, for example, based on log classification rules. If the determination unit 120 determines that a similar communication log set exists (S250: Yes), it retrieves the access information of the similar communication log set from the access information table (S260). In addition, the determination unit 120 associates the communication log set ID of the similar communication log set with the received logs.

[0136] On the other hand, if the determination unit 120 determines that there is no communication log set similar to the received log (S250: No), it appends the communication log set containing the received log as a new communication log set to the communication log set table (S270). That is, the determination unit 120 associates the communication log set ID that is not in the communication log set with the received log. As described above, the determination unit 120 classifies the received log by searching for past logs similar to the received log and associating the received log with the communication log set ID based on the search results.

[0137] Furthermore, if the determination unit 120 determines in step S220 that it is not anonymous communication (S220: No), that is, if it determines that the packet containing the command to control the home appliance to become the device information represented by the received log is not a packet sent via anonymous communication, it determines, based on the communication log set table, whether the IP address represented by the sending source IP contained in the received log has been observed (S280). In other words, the determination unit 120 determines whether the sending source IP contained in the received log is included in logs received earlier than that log.

[0138] If the determination unit 120 determines that the observation has been completed (S280: Yes), it retrieves the access information of a matching communication log set from the access information table, that is, a communication log set containing logs with the same source IP as those in the received logs (S290). Furthermore, the determination unit 120 associates the communication log set ID of this communication log set with the received logs. On the other hand, if the determination unit 120 determines that the observation has not been completed (S280: No), it appends the communication log set containing the received logs as a new communication log set to the communication log set table (S300). That is, the determination unit 120 associates a communication log set ID that is not present in the communication log set with the received logs. As described above, even in cases where communication is not anonymous, the determination unit 120 classifies the received logs by associating the received logs with the communication log set ID based on the source IP.

[0139] Figure 10 This is a flowchart illustrating the processing steps of the home appliance server 100 according to the implementation method for detecting slow attacks. Specifically, Figure 10 This indicates that the attack detection unit 110 is performing [the following actions]. Figure 8 The flowchart shows the details of step S150. For example, at the end of a day, the attack detection unit 110 performs an attack on communication log sets that have had new logs appended to them, including sets of more than one communication log set. Figure 10 The processing shown.

[0140] First, the attack detection unit 110 calculates the average number of accesses based on one or more logs included in the communication log set (S410). Next, the attack detection unit 110 calculates the access frequency based on one or more logs included in the communication log set (S420). Finally, the attack detection unit 110 calculates the access duration in days based on one or more logs included in the communication log set (S430).

[0141] Furthermore, the order in which steps S410 to S430 are executed can be arbitrary. For example, after executing steps S410 to S430, the attack detection unit 110 updates the access information table based on the calculation results of each step.

[0142] Next, the attack detection unit 110 uses the average number of accesses, access frequency, and access duration calculated in steps S410 to S430 to perform the following steps S440 to S490.

[0143] The attack detection unit 110 determines whether the calculated average number of visits is more than the first threshold (S440).

[0144] If the attack detection unit 110 determines that the calculated average number of accesses is more than the first threshold (S440: Yes), it determines that it is not a slow attack (S450). That is, the attack detection unit 110 determines that the logs contained in the communication log set are not logs that represent control content corresponding to the commands contained in the packets sent for the purpose of carrying out a slow attack.

[0145] On the other hand, if the attack detection unit 110 determines that the calculated average number of visits is below the first threshold (S440: No), it determines whether the calculated number of days of access is longer than the second threshold (S460).

[0146] If the attack detection unit 110 determines that the calculated number of access duration days is below the second threshold (S460: No), it determines that it is not a slow attack (S450).

[0147] On the other hand, if the attack detection unit 110 determines that the calculated number of days of access is longer than the second threshold (S460: Yes), it determines whether the access frequency is greater than the third threshold (S470).

[0148] If the attack detection unit 110 determines that the access frequency is below the third threshold (S470: No), it determines that there are signs of a slow attack (S480). That is, the attack detection unit 110 determines that the logs contained in the communication log set may be logs that represent control content corresponding to commands contained in packets sent for the purpose of carrying out a slow attack.

[0149] If the attack detection unit 110 determines that the access frequency is higher than the third threshold (S470: Yes), it determines that it is a slow attack (S490). That is, the attack detection unit 110 determines that each log contained in the communication log set is a log that represents control content corresponding to the commands contained in the packets sent for the purpose of carrying out the slow attack.

[0150] Figure 11 This is a flowchart illustrating the information processing method involved in the implementation method.

[0151] For example, the information processing device includes a processor and a memory, and the processor uses the memory to perform the following processing. An example of such an information processing device is the aforementioned home appliance server 100.

[0152] First, the information processing device categorizes the device logs into any one of multiple groups based on the device status, which indicates the status of the device controlled according to the command contained in the communication packet (S10). For example, the information processing device obtains multiple logs of the device from a device that collects logs of home appliances and other devices in a home network, such as a home controller 200, and categorizes the obtained multiple logs into any one of multiple groups. The information processing device may also obtain the logs from a storage device such as a storage unit 150.

[0153] Communication packets are, for example, packets sent from an external control device to the home controller 200. Furthermore, communication packets can be sent directly to the device, or via an anonymous communication server 300 or similar means to the home controller 200 or the device.

[0154] Additionally, the device could be a household appliance such as an air conditioner 210. Furthermore, the device can be any device that can be controlled via communication, and does not necessarily have to be a household appliance. Additionally, the device's log could be information indicating the control content performed by the device, information indicating the control content performed by the home controller 200, or information indicating the control content of commands contained in communication packets.

[0155] In addition, a group is, for example, the communication log set mentioned above.

[0156] Next, the information processing device detects slow attacks based on one or more logs classified into each of the multiple groups (S20). Specifically, the information processing device determines whether one or more logs in each group, obtained by classifying the device's logs, are logs representing control content corresponding to commands contained in communication packets sent for the purpose of carrying out slow attacks.

[0157] Information processing devices, such as displays, show the detection results of slow attack attacks. This allows users to confirm whether they have been subjected to a slow attack.

[0158] [Effects, etc.]

[0159] The following describes the technologies that can be obtained from the disclosure of this specification, and explains the effects that can be obtained from the illustrated technologies.

[0160] Technique 1 is an information processing method, comprising: classifying device logs into any one of multiple groups based on device status representing the state of a device controlled according to commands contained in a communication packet (S10); and detecting slow attacks based on one or more logs classified into each of the multiple groups (S20).

[0161] Therefore, slow / low-speed attacks can be detected based on the classification results of logs based on device status. Thus, slow / low-speed attacks can be detected without relying on the IP address of the sending source. Therefore, even if multiple sending sources use the same IP address through anonymous communication, or even if the same sending source uses different IP addresses, logs can be classified into any of the multiple groups based on device status, and slow / low-speed attacks can be detected on a per-group basis. Slow / low-speed attacks are believed to be carried out by repeatedly sending communication packets containing the same commands. Therefore, devices subjected to slow / low-speed attacks are highly likely to repeatedly execute the same control content. Therefore, by detecting slow / low-speed attacks by group based on logs classified according to device status, high-precision detection of slow / low-speed attacks is possible.

[0162] Technique 2 is based on the information processing method described in Technique 1, which determines whether a communication packet is sent through anonymous communication. If it is determined that the communication packet is sent through anonymous communication, the device logs are classified into any one of multiple groups based on the device status.

[0163] Therefore, even if multiple sending sources become the same IP address through anonymous communication, or even if they are the same sending source but become different IP addresses, logs can still be classified based on device status to detect slow attacks with high accuracy.

[0164] Technique 3 is based on the information processing method described in Technique 1 or 2, in the detection of slow and low attack, determining whether it is a slow and low attack, or has signs of a slow and low attack, or is not a slow and low attack based on more than one log classified into each group.

[0165] This allows for the detection of slow attack mechanisms. Furthermore, by identifying signs of slow attacks, users can be notified early, even when it is difficult to determine if a slow attack is present.

[0166] Technique 4 is an information processing method according to any one of Techniques 1 to 3, in detecting slow attacks, detecting slow attacks based on at least one of the following: the average number of daily accesses to the device, the duration of accesses to the device, and the frequency of accesses to the device, calculated based on more than one log classified into each group.

[0167] Therefore, it is possible to detect slow and low-speed attacks with high accuracy.

[0168] Technique 5 is based on the information processing method described in Technique 4. In the detection of slow attacks, if the average number of accesses is more than the first threshold, it is determined that it is not a slow attack.

[0169] Therefore, it is possible to detect slow and low-speed attacks with high accuracy.

[0170] Technique 6 is based on the information processing method described in Technique 4 or 5, in the detection of low-slow attacks, if the number of days of access is below the second threshold, it is determined that it is not a low-slow attack.

[0171] Therefore, it is possible to detect slow and low-speed attacks with high accuracy.

[0172] Technique 7 is an information processing method according to any one of Techniques 4 to 6, in the detection of slow attacks, if the average number of accesses is below a first threshold and the number of accesses lasts longer than a second threshold, it is determined to be a slow attack or has signs of a slow attack.

[0173] Therefore, it is possible to detect slow and low-speed attacks with high accuracy.

[0174] Technique 8 is based on the information processing method described in Technique 7. In the detection of slow attacks, if the access frequency is higher than the third threshold, it is determined to be a slow attack; if the access frequency is lower than the third threshold, it is determined to have signs of a slow attack.

[0175] Therefore, it is possible to detect slow and low-speed attacks with high accuracy.

[0176] Technology 9 is an information processing device comprising: a classification unit that classifies device logs based on device status indicating the state of a device controlled according to commands contained in a communication packet; and a detection unit that detects slow attacks based on the classified device logs.

[0177] The classification unit is, for example, the determination unit 120 described above. The detection unit is, for example, the attack detection unit 110 described above. The information processing device is, for example, the home appliance server 100 described above.

[0178] Therefore, it achieves the same effect as the information processing method involved in one of the technical solutions disclosed herein.

[0179] Technique 10 is a program for a computer to execute the information processing method described in any one of Techniques 1 to 8.

[0180] Therefore, it achieves the same effect as the information processing method involved in one of the technical solutions disclosed herein.

[0181] (Other implementation methods)

[0182] The implementation methods have been described above, but this disclosure is not limited to the above-described implementation methods.

[0183] For example, in the above embodiment, the home appliance server 100 functions as an information processing device, but any device in the communication system 10 can be used to detect slow attacks. For example, the home controller 200 can be used to detect slow attacks, or devices such as the air conditioner 210 or the lighting equipment 220 can be used to detect slow attacks.

[0184] Alternatively, for example, the information processing apparatus described in the above embodiments can be implemented as a single apparatus having all the constituent elements, or it can be implemented by assigning each function to multiple apparatuses and having those multiple apparatuses cooperate.

[0185] Furthermore, in the above embodiments, the processing performed by a specific processing unit can also be performed by another processing unit. Additionally, the order of multiple processes can be changed, and multiple processes can be executed in parallel.

[0186] Furthermore, in the above embodiments, each component can also be implemented by executing a software program suitable for that component. Each component can be implemented by reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory using a program execution unit such as a CPU or processor.

[0187] Furthermore, each component can also be implemented using hardware. For example, each component can be a circuit (or integrated circuit). These circuits can be configured as a whole into a single circuit, or they can be separate circuits. Additionally, these circuits can be general-purpose circuits or dedicated circuits.

[0188] Furthermore, the general or specific technical solutions of this disclosure can be implemented by apparatus, systems, methods, integrated circuits, computer programs, or non-transitory recording media such as computer-readable CD-ROMs. Additionally, the general or specific technical solutions of this disclosure can also be implemented by any combination of apparatus, systems, methods, integrated circuits, computer programs, and recording media.

[0189] Furthermore, this disclosure also includes various modifications to the embodiments that would be conceived by those skilled in the art, or methods implemented by arbitrarily combining the constituent elements and functions of the embodiments without departing from the spirit of this disclosure.

[0190] Industrial availability

[0191] This disclosure is useful for computers that store logs of IoT devices.

[0192] Explanation of reference numerals in the attached figures

[0193] 10 Communication Systems; 100 Home Appliance Servers; 110 Attack Detection Units; 120 Judgment Units; 130 Communication Units; 140 Display Units; 150 Storage Units; 200 Home Controllers; 210 Air Conditioning Equipment; 220 Lighting Equipment; 230 Electric Roller Shutters; 300 Anonymous Communication Servers; 400 Domain Name Registration Information Servers.

Claims

1. An information processing method, comprising: Based on the device state, which indicates the state of the device controlled according to the commands contained in the communication packet, the device's logs are categorized into any one of multiple groups. For each of the multiple groups, slow attacks are detected based on more than one log entry categorized into each group.

2. The information processing method according to claim 1, Determine whether the communication packet was sent via anonymous communication. If it is determined that the communication packet was sent through the anonymous communication, the device's logs are classified into any one of the multiple groups based on the device status.

3. The information processing method according to claim 1, In the detection of the slow attack, based on more than one log in each group, it is determined whether it is the slow attack, or has the symptoms of the slow attack, or is not the slow attack.

4. The information processing method according to claim 1, In the detection of the low-slow attack, the attack is detected based on at least one of the following: the average number of daily accesses to the device, the duration of accesses to the device, and the frequency of accesses to the device, calculated from more than one log file categorized into each group.

5. The information processing method according to claim 4, In the detection of the slow attack, if the average number of accesses is more than the first threshold, it is determined that it is not the slow attack.

6. The information processing method according to claim 4, In the detection of the slow attack, if the number of days of access is below the second threshold, it is determined that it is not the slow attack.

7. The information processing method according to claim 4, In the detection of the slow attack, if the average number of accesses is below the first threshold and the number of accesses lasts longer than the second threshold, it is determined to be the slow attack or to have the signs of the slow attack.

8. The information processing method according to claim 7, In the detection of the aforementioned slow attack, If the access frequency is higher than the third threshold, it is determined to be a low-speed attack. If the access frequency is below the third threshold, it is determined to be a sign of the slow attack.

9. An information processing device, comprising: A classification department, which classifies the device's logs into any one of a plurality of groups based on a device state indicating the state of the device controlled according to commands contained in a communication packet; and The detection unit detects slow attacks based on more than one log entry categorized into each of the multiple groups.

10. A program for a computer to execute the information processing method according to any one of claims 1 to 8.

Images