METHOD FOR CONFIGURING A DETECTION SYSTEM FOR CHARACTERIZING ANOMATIC OPERATING STATES OF A COMPUTER SYSTEM

Description

[0001] The invention relates to a method for configuring a detection system for characterizing anomalous operating states of a computer system.

[0002] It is known from the prior art to use logs, i.e., messages generated by programs running on a computer system, to assess whether the computer system in question is in an anomalous operating state. The finding that the operating state is anomalous, i.e., deviates from a previously existing normal state, allows for various conclusions about the operation of the computer system; for example, the detection of an anomalous operating state can indicate manipulation of the computer system.

[0003] The prior art includes several methods that compare two different log lines from log files, thereby deriving typical patterns and detecting anomalous operating states of a computer system. This comparison is usually token-based between two log lines, meaning that the log lines are assumed to consist of blocks of characters or substrings separated by predefined characters, such as spaces.

[0004] Such procedures generally make it possible to find anomalous states in a computer system, but due to the pairwise comparison only, they are associated with high resource requirements and consequently high time expenditure when a large number of log lines are to be examined, since each individual log line must be compared with all other log lines already classified as benign.

[0005] Various detectors are available in the prior art that allow deviations in protocol lines to be detected according to different patterns. However, the problem is that a detector is only suitable for detecting a specific type of deviation, and it is not possible to identify a detector capable of detecting deviations in a specific system configuration for every type of potentially occurring anomaly.

[0006] Furthermore, it is not easily possible to configure a detector so that it is sensitive to all possible anomalies in advance.

[0007] The publication by Max Landauer et al., "AMiner: A Modular Log Data Analysis Pipeline for Anomaly-based Intrusion Detection", DIGITAL THREATS: RESEARCH AND PRACTICE (DTRAP), ACMPUB27, New York, NY, Vol. 4, No. 1 (2023-03-31), pages 1-16, XP058983819, ISSN: 2692-1626, DOI: 10.1145 / 3567675, discloses a log-based anomaly detection method simplified by using an open-source tool in the AECID toolbox that enables log analysis, evaluation, and alerting.

[0008] The object of the invention is therefore to configure a detection system in such a way that, after this configuration, it is able to detect anomalous operating conditions with different detectors without having to make special manual adjustments to individual detectors used.

[0009] The invention solves this problem in a method of the type mentioned at the outset with the features of claim 1.

[0010] It is intended that: During operation of the computer system (1), logs are created by the computer system (1) by creating a log record in the form of a log line (P; P1, P2, P3) for each of the specified events upon their occurrence, extracting a number of values ​​from the log line (P; P1, P2, P3) and assigning each of these values ​​to a key, specifying a number of detectors for the detection system, each detector being assigned the following: a detection criterion applicable to one or more values ​​assigned to a log line given a specific key, indicating for one or more log lines to be examined whether they originate from a normal operating state, one or more key selection parameters,a number of configurable configuration parameters, in particular thresholds and / or setpoints, which prescribe which criteria the value(s) identified by the key selection parameter(s) must satisfy in order to satisfy the detection criterion, a method for adapting the configuration parameters of the detector to the values ​​identified by the key selection parameters, such that the configuration parameters of the detector are set so that a predetermined number or proportion, in particular all, of predetermined normal protocol lines originating from a normal operating state correspond to the detector's criterion, optionally selecting several detectors of different types.wherein a number of normal log lines are specified that were created during a normal operating state, and wherein a number of detectors are configured, based on their associated method for adjusting the configuration parameters, such that the specified normal log lines or a specified minimum proportion of these specified log lines meet the detection criterion, wherein at least one detector is configured to detect an anomalous operating state by specifying several key selection parameters to select a tuple of values ​​from the respective log line, and a detection criterion is specified by determining the set of tuples of values ​​from the specified normal log lines selected by the respective key selection parameters and specifying this set as a configuration parameter.where a log line to be examined is recognized as indicating an anomalous operating state if the tuple selected from that log line by the key selection parameters is not included in the determined set of tuples, . and where, for each key selection parameter, it is examined separately based on the specified normal protocol lines whether the number of new distinct values ​​occurring per unit of time, or the proportion of new distinct values ​​occurring in relation to the total number of log lines specified for parameter adjustment, which are assigned to the respective key selection parameter in the protocol lines, are below a predefined threshold or threshold function, and that a key selection parameter is only used for the formation of tuples in this case.

[0011] To limit the number of detectors to be used, to speed up configuration, and to reduce false positives, it may be provided that each detector is assigned a test criterion indicating whether the method for adjusting the configuration parameters is applicable or has been correctly applied to certain values ​​defined by a key within a number of normal protocol lines, and that if the test criterion is not met, a detector is discarded and / or not used for adjusting the configuration parameters and / or the adjustment of the configuration parameters for that detector is aborted.

[0012] A preferred adaptation to further protocol lines that indicate a normal operating state, which allows a reduction of false positives, is characterized by the fact that the configuration of the detectors is optimized as follows: The process involves selecting log lines that were all created during normal operation of the computer system, especially normal log lines; evaluating these log lines using the detectors; adjusting the configuration parameters based on the evaluation by the detectors, such that a minimum proportion and / or a minimum number of log lines are identified as normal or a maximum number of log lines are not identified as normal; and / or, if an adjustment of the configuration parameters is not possible or adjustable configuration parameters are not available, removing the respective detector.

[0013] In a detector that is easy to implement, it is intended that at least one detector is configured to detect an anomalous operating condition by When a key selection parameter is set to select a value from the respective log line, the set of values ​​contained in the specified normal log lines and selected by the key selection parameter is determined and set as a configuration parameter, whereby a log line to be examined is then recognized as an indication of an anomalous operating state in accordance with the detection criterion if the value selected from this log line by the key selection parameter is not contained in the determined set.

[0014] To avoid applying this detector to randomly distributed values, it may be provided that the detector uses the normal protocol lines as a test criterion to check whether the number of newly occurring distinct values ​​within the set over time or with an increasing number of normal protocol lines is below a predetermined threshold or threshold function.

[0015] A simple determination of a threshold for the aforementioned stability criterion is achieved by dividing the number of normal log lines in the order of their occurrence or the time spent creating the normal log lines into a number of sections that preferably have the same duration or comprise the same number of normal log lines. that for each of these sections of the threshold function a proportion or number of maximum permissible newly occurring distinct values ​​of the quantity is specified separately, that the newly occurring distinct values ​​of the quantity are compared section by section with the values ​​of the threshold function, and if the newly occurring distinct values ​​exceed the threshold function, the test criterion is not met and / or the detector is discarded.

[0016] To advantageously apply this detector to suitable values, it can be provided that, as a test criterion, before adjusting the configuration parameters, it is checked using the specified normal protocol lines whether, in a number of normal protocol lines or a proportion of normal protocol lines exceeding a threshold, values ​​for all those defined by the key selection parameters are present or assigned to the respective normal protocol line.

[0017] Another detector provision stipulates that at least one detector is configured to detect an anomalous operating condition by A key selection parameter is set to specify a string value from the respective log line; a number of character frequency values ​​are determined from the strings contained in the normal log lines and specified by the key selection parameters, each of which indicates how often a particular character occurs in the respective string; a number of character pair frequency values ​​are determined from the strings contained in the normal log lines and specified by the key selection parameters, each of which indicates how often a given first character in the respective string is followed by a given second character. Subsequently, for each of the specified normal protocol lines, substrings comprising two characters each are formed from the value of a normal protocol line to be examined, as determined by the key selection parameter. For each of these substrings, the quotient of the character pair frequency value for the substring and the character frequency value for the first character is calculated. From all these quotients, the mean value for the normal protocol line to be examined is calculated, and a threshold value is determined as a configuration parameter, which corresponds to the minimum of the aforementioned mean values ​​of the individual normal protocol lines, optionally reduced by a specified value. A protocol line to be examined is then checked for the presence of an anomalous operating state in accordance with the detection criterion.by forming substrings comprising two characters each from the value of a log line to be examined, as determined by the key selection parameter, calculating the quotient of the character pair frequency value for the substring and the character frequency value for the first character for each of these substrings, and calculating the mean value for the log line to be examined from all these quotients, and , If this mean value is below a predefined threshold, the protocol line under investigation is recognized as an indication of an anomalous operating condition according to the detection criterion.

[0018] To detect anomalous operating conditions using a configured set of detectors, the following may be provided: that during the operation of the computer system, protocol lines are determined, that the configured detectors examine the protocol lines determined in this way for the presence of an anomalous state, and that an anomalous operating state is detected if at least one of the detectors recognizes one of the protocol lines as anomalous.

[0019] The invention further relates to a data carrier on which a program for carrying out a method according to the invention is stored.

[0020] The invention is described in more detail using a preferred embodiment: Fig. 1 Figure 1 schematically shows an example of a computer system 1 in which several processes 2a, 2b, 2c run on a computer 10. At different times, when predefined events occur, processes 2a, 2b, 2c create log records for each of these events in the form of character strings called log lines P. In the embodiment shown in Fig. 1 For example, three log lines P1, P2, P3 are created.

[0021] The individual log lines P1, P2, and P3 can each be forwarded in real time and written to a central log file 4 in chronological order, e.g., according to their creation time, and / or further processed. Alternatively, the log lines P1, P2, and P3 can each be stored in a log file 4a, 4b, and 4c belonging to the respective process 2a, 2b, and 2c. In this case, the individual log lines P1, P2, and P3 are typically written to the respective log files 4a, 4b, and 4c in the order of their creation time. At a later time, the individual log records from the log files 4a, 4b, and 4c can be written to a common central log file 4.

[0022] Before individual log lines can be evaluated, a configuration of several detectors is performed, using normal log lines as a reference. These lines were captured when the computer system was in a normal operating state. The entirety of these detectors is also referred to as the detection system.

[0023] For both detector configuration and the actual detection of anomalous operating conditions, a number of features are extracted from the log lines—that is, normal log lines or log lines to be examined—and assigned to the respective log line. If a log line has a predefined format, values ​​can be extracted from it according to predefined criteria. As an example, a log line with the following content is examined here to extract individual values: type = USER_START msg = audit (1642760221.565:662) : pid=14286 uid=0 auid=0 ses=98 msg='op=PAM:session_open acct="root" exe=" / usr / sbin / cron" hostname=? addr=? terminal=cron res=success' If, for example, the respective log line contains a constant string, e.g. "acct=", the following value can be assigned to the log line. "root" can be assigned a value, for example, to the log line. " / usr / sbin / cron" A value is assigned when the string "exe=" is found. This allows different values ​​with different keys to be assigned to each log line. The individual values ​​indexed by the keys are referred to as variables. Depending on the syntax used to create the log line, different parsers or extraction routines can be used to extract the individual key / value pairs and assign them to the respective log line.

[0024] At the end of this process, which is carried out according to the same specifications for each of the normal log lines or log lines to be examined, a data structure is available that allows each log line to be associatively assigned any number of values ​​based on a specific key. This data structure can, for example, be represented as a table, whereby not every key in each log line needs to have a value assigned to it. Nr A B C D E 0 a b10 ABC d1 c2 1 a b0 xyz c2 2 b12 ABC d1 3 a ABC c1 4 a b0 xyz d1 5 a b18 xy d2 c2 6 a b12 xy d1 c1 7 b13 ABC c2 8 a b2 ABC c2 9 a b12 xyz d1 10 a b8 xyz c2 11 b11 xyz d2

[0025] Subsequently, different detector types are predefined for configuration, which can be adapted to discriminate individual log lines. To effectively check log lines, it may be necessary to use multiple detector instances, whether of the same or different types. In particular, multiple instances of the same detector can be applied to different variables. Constant Value Detector

[0026] The simplest type of detector checks whether a log line with a given key is associated with the same value. For example, such a detector can be used to check whether the log line with the key "A" is assigned the value "a".

[0027] In order to adapt the detector described above to the specified normal protocol lines, the detector has parameters with which the criterion can be adapted to the respective situation.

[0028] First, a key is selected using a key selection parameter, here the key "A".

[0029] Furthermore, the detector type in question is also assigned a method for adjusting the detector's configuration parameters. This method examines, for each key, whether the detector can be configured so that a number of normal protocol lines meet the detector's criteria. In this case, for example, the configuration method can examine the individual values ​​assigned to a key to see if they are identical. If this is the case, as with key "A" in this example, the key selection parameter is set to the name of key "A," and the other configuration parameter receives the value "a." The detector has thus been configured using the described configuration method.

[0030] As a result, the detector is configured to check whether a value "a" is assigned to a log line under the key "A". If no value is assigned to the relevant key "A" for a log line under investigation, as is the case for line 7, for example, no detection is performed; the line is ignored.

[0031] This process can be repeated for the other keys, e.g., "B" or "C," but configuring the described detector type using this parameter adjustment method is not possible. Therefore, detector instances with the key selection parameters "B" and "C" are not created. Detector for multiple possible values

[0032] A simple modification of the detector described above allows the respective variable, or the value identified by the key selection parameter in the log line to be examined later, to be assigned not just a single value, but a multitude of different possible normal values. Assuming that only normal log lines originating from a normal state of the computer system are analyzed during parameter adjustment, each of these values ​​can be stored as normal, so that the occurrence of all these values ​​can be considered normal when subsequently examining log lines.

[0033] An anomalous operating state can therefore be detected during a subsequent check if a value for the corresponding key is found in a log line under investigation that did not occur during the configuration parameter adjustment or was not present in the normal log lines. This detector thus always triggers an alarm or detects an anomalous state when new and unknown values ​​of a variable are found. Therefore, when adjusting the configuration parameters, it is advisable to present the detector with values ​​that contain a limited set of values.

[0034] To configure this detector, a key selection parameter is first set in order to extract a specific value, defined by this key selection parameter, from the respective log line.

[0035] To adjust the configuration parameters, the values ​​indexed by the key selection parameter in the normal log lines are determined. The set of values ​​selected by the key selection parameter in the normal log lines is defined and stored in a data structure, such as a list. This set is defined as the configuration parameter, or as the set of values ​​indicating a normal state, and assigned to the detector. Generally, it is possible to define the set by storing values ​​that appear multiple times in the normal log lines only once.

[0036] In detection mode, i.e., after configuration, a log line to be examined is recognized as an indication of an anomalous operating state if the value selected from this log line to be examined by the key selection parameter is not included in the determined set of values ​​indicating a normal state.

[0037] To verify whether the values ​​specified by the relevant key selection parameter are suitable for the detector's application, the following test criterion can be used. This criterion checks whether the number of permissible values ​​for the variable is stable, i.e., whether the number of unique values ​​in the normal protocol lines for the variable in question approaches a constant value. When the number of elements of a set is mentioned in this context, it always refers to the number of unique elements.

[0038] To check whether the number of occurring values ​​meets this stability criterion, a function f(x) is created that specifies the number of unique values ​​over the number of normal protocol lines (function f(x)). For example, if 10 unique values ​​have been determined after analyzing 100 normal protocol lines, then f(100) = 10.

[0039] The function f(x) can alternatively be understood as the number of unique values ​​of a given variable over time. For example, if N normal log lines have been determined after 50 seconds during a normal operating state underlying the parameter adjustment, and 15 unique values ​​have been determined in these N normal log lines, then f(50s) = 15.

[0040] Preferably, the axes of the function f(x) are normalized beforehand, i.e. scaled, for example in a form such that f(0)=0 and f(1)=1.

[0041] To determine the stability of the observed values, it is investigated whether the function f(x) converges to a certain value or ceases to change significantly after a specific number of normal protocol lines or after a certain time. To establish such stability, it is preferable to examine not the previously described function f(x) itself, but rather its first time derivative f'(x). The first time derivative can then be approximated in various ways.

[0042] This time derivative f'(x) thus describes the change in the number of unique values ​​per log line over the course of the log lines. To satisfy the test criterion, i.e., the stability criterion, the time derivative f'(x) should approach zero at the end of the configuration process; that is, no new values ​​should be added after a certain point in time.

[0043] To quantify such behavior, the next step involves defining an upper limit for the time derivative f'(x), which must not be exceeded by the time derivative f'(x) of a function classified as stable. Such a limit can be defined by dividing the time-varying indices x of the individual log rows into a number of n segments. For each of these segments, a limit value for the time derivative f'(x) is specified.

[0044] Since the change f'(x) in the number of unique values ​​does not exceed 1, this mean value - since only one new value can be added per log line - can be perceived as a relative change per segment.

[0045] To define the boundary curve precisely, the user can now specify the individual limit values ​​segment by segment. Since these limit values ​​always represent a relative change, they can be fixed regardless of the number of log lines used; adjustments are generally not necessary.

[0046] An example of segment-defined limits is [1, 0.7, 0.3, 0.1]. In such a situation, the sequentially arriving normal protocol lines would be divided into four segments of equal length. For the first segment, i.e., the first quarter of the occurring values, a 100% change is permitted; that is, during this segment, only distinct values ​​for the variable in question can occur. For the second segment, a 70% change is permitted; that is, only 70% of the normal protocol lines for the variable in question may contain new values, while the remaining 30% of the protocol lines for the variable in question must contain values ​​that have already occurred in a previous normal protocol line. In the two subsequent segments, this proportion must be less than 30%, respectively, according to the example limit function given.It should be 10% to determine the stability of the values.

[0047] If the mean values ​​of the derivative of the curve f'(x) in the individual segments are less than or equal to the threshold values ​​specified by the limit curve, a key-indexed variable is considered stable. Such a detector can then be used to check the protocol lines under investigation.

[0048] The stability described above serves as a test criterion for the detector in this case. If this test criterion is met, the individual values ​​found during the configuration process for the variable in question are passed to the detector for later examination of log lines. The detector can then be used to check newly occurring log lines. However, if the variable in question is not stable among the log lines according to the specified test criterion, the detector is discarded, meaning that the variable in question is not checked.

[0049] The present detector has the advantage that the test criterion can be determined simultaneously with, or in conjunction with, the adjustment of the configuration parameters. While the individual normal protocol lines are passed to the detector for adjusting the configuration parameters or for determining the set of normal values, the expansion of the function f(x) or its derivative f'(x) can be checked at the same time. If it turns out that, for example, in the second segment, the number of newly added values ​​is greater than 70% of the normal protocol lines used here, the adjustment of the configuration parameters can be aborted and the detector discarded, or at least not used with the relevant key selection parameter.

[0050] For the general configuration and testing of the detector, only the shape of the limit curve for the time derivative f'(x) is required, i.e., the number of segments used and the individual constant threshold values ​​chosen for the segments. No further settings or dynamic adjustments are necessary.

[0051] In addition to a detector that is sensitive to the occurrence of certain values, a detector applicable to string variables may also have a detection criterion that detects an anomaly if the strings of the variable in question contain a character or symbol that is not included in a list of valid characters determined during parameter fitting. Detection of combinations

[0052] As part of the invention, it is also possible to use a detector that accesses not just a single variable value indexed by a key, but a multitude of such values. The detector described here is therefore similar to the previously described detector, but differs in that it examines combinations of variables rather than individual variables. Accordingly, a log line is recognized as anomalous if a new and unknown combination of values ​​is found for the corresponding variable combination or tuple.

[0053] To define these variables, several key selection parameters are set to extract values ​​from the respective log line. During parameter adjustment, a set of tuples representing the values ​​selected by the respective key selection parameters from the normal log lines is determined. This set of tuples forms a configuration parameter that is assigned to the respective detector for subsequent anomaly detection.

[0054] A tuple is defined as an ordered set of elements. The key selection parameters clarify which variable's value corresponds to which position within each tuple. Depending on the key selection parameters, each tuple contains a predetermined number of values, which is the same for all tuples. Two tuples are considered equal—in the context of the later definition of uniqueness—if all their entries are identical element-wise. If a variable in a standard protocol line does not have a corresponding value, a NULL entry can be made in the tuple in question. Alternatively, the relevant standard protocol line can be excluded from further configuration parameter adjustments.

[0055] For example, if it turns out that certain combinations or tuples of variable values ​​frequently occur together, or that individual tuples formed from the respective variable values ​​of a normal log line always originate from a predefined set of tuples, a detector can be configured to classify log lines as anomalous if their corresponding tuples of variable values ​​are not contained in the relevant set. For example, given the two key selection parameters "A" and "D", the following set of tuples can be identified: {["a", "d1"], ["a", "d2"], ["a", NULL], [NULL, "d2"]}.

[0056] The detector uses the normal protocol lines as a test criterion to check whether, in a number of normal protocol lines or a proportion of normal protocol lines exceeding a threshold, values ​​selected by the defined key selection parameters are present or assigned to the respective normal protocol line.

[0057] A detection criterion can then be defined such that a log line to be examined is recognized as an indication of an anomalous operating state if the tuple selected from this log line by the key selection parameters is not included in the determined set.

[0058] Before configuring the detector according to this method and identifying permissible sets of tuples for all possible combinations of variables that the detector can use, it is advantageous to check beforehand for individual, meaningfully usable variables and variable combinations. Otherwise, a large number of possible tuple combinations, and thus a large number of detectors, would have to be configured. Ideally, a check according to the following criterion should be performed before adjusting the parameters.

[0059] For the test, all variables are examined individually, with the exception of random variables, which are not used to form tuples. In this context, a random variable is defined as one that does not satisfy the previously described stability criterion, possibly with a differently defined limit function, and typically yields a new value for each new normal protocol line. Random variables thus possess an unbounded set of values ​​and frequently lead to random combinations of values ​​and long, potentially incomplete sets of tuples. This means that a combination containing one or more random variables will produce a new and previously unknown combination of values ​​for almost every new normal protocol line.Therefore, it is hardly possible for a detector to make a useful parameter adjustment from combinations containing random variables and thus learn normal behavior.

[0060] For each key selection parameter, the stability is examined separately using the normal protocol lines, as described above. The measure of stability can be either the number of new, distinct values ​​occurring per unit of time or the proportion of new, distinct values ​​to the total number of normal protocol lines assigned to the respective key selection parameter. If this measure is below a predefined threshold or below a predefined threshold function, the respective key selection parameter can be used and defined for tuple generation. The threshold functions described above can be used for this purpose.However, it is also possible to use different thresholds or threshold functions for the use of a variable in tuples.

[0061] This measure reduces the computational effort required to adjust the configuration parameters, thus preventing the configuration of numerous unproductive detectors. The process of filtering out random variables is similar to the selection of stable variables.

[0062] It is also possible to exclude constant variables beforehand, since adding them does not provide any additional insights. This drastically reduces the number of detector instances required.

[0063] The exemplary procedure described above for detecting suitable combinations of variable values ​​was demonstrated using pairs of variables, i.e., tuples with two entries each were used. In principle, such a procedure is also possible for combinations of multiple variables.

[0064] Due to the large number of possible variable combinations, it has proven simpler to first identify individual pairs of variables. If it turns out that individual variables are contained in several such combinations, these pairs can be grouped into N-tuples. For example, if it turns out that both the variable combination ["A", "D"] and the variable combination ["A", "E"] can be used for parameter fitting, a 3-tuple or triple ["A", "D", "E"] can also be used. The advantage of this approach is that, to identify this triple, it is not necessary to examine all three combinations of the variables, but only all two combinations. Entropy detector

[0065] The following describes another detector that processes variable values ​​of type string and detects anomalies in individual variables of the log lines under investigation based on character pair probability, i.e., the probability that one character follows a specific other character. Such a detector is described, for example, in: M. Landauer, M. Wurzenberger, F. Skopik, W. Hotwagner, and G. Höld, "Aminer: A modular log data analysis pipeline for anomaly-based intrusion detection," Digital Threats, vol. 4, Mar 2023 .

[0066] For this detector, as with the detectors described previously, a key selection parameter is used to determine which value is to be extracted from the respective normal protocol line. This value is a string.

[0067] The configuration parameters of this detector are adjusted by creating frequency tables. A number of character frequency values ​​f("a") are determined, where each of these character frequency values ​​indicates how often a character occurs in the respective string selected in the normal protocol lines by the key selection parameter. An associative memory can be used to store this table, for example, assigning the respective frequency value to the character "a" as its key.

[0068] Subsequently, a character pair frequency table is created for each pair of consecutive characters or symbols. This table determines the number of character pair frequency values, where each value indicates how often a first character (e.g., "a") follows a second character (e.g., "b") in the respective string. The strings used to create this table are selected from the normal protocol lines by the key selection parameter. A double-associative memory can be used to store this table, assigning the respective character pair frequency value to the characters "a" and "b" as key tuples.

[0069] Subsequently, for the normal protocol lines, substrings consisting of two characters each are formed from the values ​​specified by the key selection parameter. For example, if one of the selected values ​​corresponds to the string "abc", the two substrings "ab" and "bc" are obtained accordingly.

[0070] For each of these substrings "ab" and "bc", the quotient of the respective character pair frequency value F("ab") and the character frequency value F("a") for the first character is calculated separately. An average value, also known as the critical value, is then calculated for the entire string selected from the respective protocol line using these quotients determined for each substring. In the case of the string "abc", this critical value p can be determined, for example, as follows:

[0071] This critical value, or mean value p, is a measure of how common or unusual a particular string or sequence of its substrings is, using the protocol lines specified for parameter adjustment as a basis for comparison. The more unusual a string is, the smaller its critical value, or mean value p.

[0072] Both the character frequency value table and the character pair frequency value table are configuration parameters used to configure the detector.

[0073] In order to determine as a detection criterion whether another string contained in a protocol line to be examined and defined by the key selection parameters is unusual in the sense of the previously specified measure and thus indicates an anomalous operating state, the critical value or mean value p can also be determined for the relevant string of the protocol line to be examined according to the previously explained calculation rule.

[0074] To determine whether a critical value or mean value p is too unusual, a lower threshold can be specified. Advantageously, this threshold can be chosen such that all strings defined by the key selection parameters in the normal log lines are considered normal. Accordingly, the threshold is set to the minimum of the critical values ​​or mean values ​​p determined for these strings. Thus, a lower threshold is defined as a configuration parameter that corresponds to the minimum of the critical values ​​or mean values ​​of the normal log lines.

[0075] To avoid false positives, this minimum can be reduced by an offset value, for example, by a value between 0.01 and 0.1, in order to create a buffer between the least probable values, which are still considered part of normal behavior, and critical values ​​that should be considered anomalous. This ensures that identical critical values, or those with very close critical values, are not classified as anomalies.

[0076] During operation, the detector determines the critical value of a log line under investigation, or of the string contained within that log line and defined by the key selection parameter. This critical value is then compared to a predefined threshold; based on this comparison, a decision is made as to whether the value, i.e., the string, is recognized as an anomaly. The detector then triggers an alarm, or detects an anomaly, if a string occurs whose critical value falls below a threshold.

[0077] The behavior of critical values ​​in the normal log lines, which originate from a normal operating state, is crucial in determining whether a variable is suitable for the detector. To determine a variable's suitability for detecting anomalous operating states, the average of all critical values ​​of the variable among the normal log lines is subsequently calculated.

[0078] This average can therefore be understood as "the average probability of a variable occurring". If a variable has many values ​​that are similar with respect to their symbols (pairs), this average value will tend to be higher.

[0079] The test criterion for using a variable identified by a key is predefined, or such a variable is selected for a detector if the average probability of occurrence of a variable exceeds a certain predefined threshold. This threshold can be predefined by the user. Parameter optimization

[0080] The following section describes a further optimization step that allows the individual detectors to be checked and optimized with regard to their suitability for detecting anomalous operating conditions. The aim of this optimization step is to adjust or eliminate detectors or instances of detectors for which configuration parameters have already been determined if they produce false positive detection results.

[0081] As part of the optimization process, additional log lines are used in a first step, all of which were generated during normal operation of the computer system. These can be the normal log lines or a subset of the normal log lines that have already been used for parameter adjustments for the detectors. However, it is also possible to use other log lines for optimization. For example, log lines from what is considered normal operation can be partitioned so that one part is used for adjusting the configuration parameters and another part for the subsequent optimization. This partitioning can be done, for instance, by specifying individual time windows within which the log lines are used for parameter adjustment, and other time windows within which the log lines are used for optimization.

[0082] In a further step, the protocol lines intended for the optimization process are transmitted to the configured detectors, which may have been checked against the test criterion, and are then checked by them.

[0083] If a detector produces too many false positives during the optimization process—that is, too many detections of an anomalous state when given log lines from a normal operating state—this detector is selected for optimization. The point at which the number of false positives is considered too high can be determined by specifying optimization parameters. This can involve specifying either a maximum number of false positives per detector during the optimization process or a maximum rate of false positives per unit of time during the optimization process.

[0084] If a detector is selected for optimization and it does not have any numerically configurable configuration parameters, such as thresholds, but only lists of permissible values, the detector can be deleted or discarded and not used for future testing.

[0085] However, if the detector has numerically adjustable configuration parameters, these configuration parameters can be adjusted so that the minimum proportion and / or a minimum number of log lines is identified as normal, or a maximum number or a maximum proportion of log lines is not identified as normal.

[0086] For a numerical configuration parameter, such as a threshold, a maximum and a minimum value can be defined for this purpose. By modifying the relevant configuration parameter within the respective minimum and maximum values, new values ​​can then be searched for at which the detector identifies a minimum proportion and / or a minimum number of log lines as normal.

[0087] If such optimization in the form of an adjustment of the configuration parameter is unsuccessful and a maximum number or a maximum proportion of the log lines is still not identified as normal, the detector in question will be discarded and will not be used for future testing.

[0088] As part of the optimization process, it is also possible to make a numerical configuration parameter more restrictive. In a subsequent step, it can be investigated whether this parameter adjustment increases the number of false positives. If this is not the case, i.e., if there is no increase in the number of false positives, the adjusted numerical configuration parameter can be used. Detection system and detection of anomalous operating conditions

[0089] The entirety of the individual detectors is referred to as the detection system. The initial selection of detector types can generally be specified by the user. Multiple detector instances, also called detectors, can be created for each detector type. Typically, different key selection parameters are used for each detector created in this way, in order to model and thus test the behavior of as many variables as possible contained in the normal protocol lines.

[0090] Based on the respective test criterion, the detectors can optionally check whether the method for adjusting the configuration parameters is applicable to specific values ​​defined by a key within a number of normal protocol lines, or whether it was applied correctly. This can be done either beforehand, simultaneously with the adjustment of the configuration parameters, or after the adjustment. Subsequently, the individual detectors can be optionally optimized as described above.

[0091] During subsequent operation of the detection system, the computer system identifies log lines to be examined. The configured detectors of the detection system analyze these identified log lines for the presence of anomalous conditions. If one of the detectors determines that a log line to be examined is anomalous according to its detection criterion, an anomalous operating state of the computer system is detected based on that log line.

Claims

1. Method for configuring a detection system for characterizing abnormal operating states in a computer system (1), wherein - protocols are created by the computer system (1) during the operation of the computer system (1), in that a protocol data record in the form of a protocol line (P; P1, P2, P3) is created for each of these events by the computer system (1) when specified events occur, wherein a number of values are extracted from the protocol line (P; P1, P2, P3) and each of these values is assigned a key respectively, - wherein a number of detectors is specified for the detection system, wherein the following is assigned to each detector: - a detection criterion which can be applied to one or more value(s) assigned to a protocol line (P; P1, P2, P3) with the specification of a specific key and indicates for one or more protocol lines (P; P1, P2, P3) to be examined whether the latter originate from a normal operating state, - one or more key selection parameters with which the criterion used by the detector can be applied to different values of a protocol line (P; P1, P2, P3) which are identified by the key selection parameter(s), - a number of configurable configuration parameters, in particular threshold values and / or setpoint values, which prescribe which criteria the value(s) identified by the key selection parameter(s) need to satisfy in order to satisfy the detection criterion, - a method for adapting the configuration parameters of the detector to the values identified by the key selection parameters, so that the configuration parameters of the detector are set in such a way that a specified number or a specified proportion, in particular all, of specified normal protocol lines originating from a normal operating state meet the criterion of the detector, - wherein, if necessary, several detectors of different types are selected, - wherein a number of normal protocol lines is specified which were created during a normal operating state, and - wherein a number of detectors are configured on the basis of the method assigned to them for adjusting the configuration parameters such that the specified normal protocol lines or a specified minimum proportion of these specified protocol lines (P; P1, P2, P3) correspond to the detection criterion, - wherein at least one detector is configured to detect an abnormal operating state, in that - a plurality of key selection parameters are defined in order to select a tuple of values from the respective protocol line (P; P1, P2, P3), - a detection criterion is defined, in that the set of tuples of values selected by the respective key selection parameters from the specified normal protocol lines (P; P1, P2, P3) is determined and this set is defined as a configuration parameter, - wherein a protocol line (P; P1, P2, P3) to be examined is then recognized as an indication of an abnormal operating state if the tuple selected by the key selection parameters from this protocol line (P; P1, P2, P3) is not contained in the determined set of tuples, characterized in that for the individual key selection parameters a separate examination is carried out on the basis of the specified normal protocol lines as to whether - the number of different values newly occurring per unit of time or - the proportion of newly occurring different values in the total number of protocol lines specified for the parameter adjustment, which are assigned to the respective key selection parameter in the protocol lines (P; P1, P2, P3) is below a specified threshold value or a specified threshold value function, and in that a key selection parameter is only used for the formation of tuples in this case.

2. Method according to claim 1, wherein each detector is assigned a test criterion which indicates whether the method for adjusting the configuration parameters is applicable to certain values of a number of normal protocol lines defined by a key, or has been correctly applied, and in the event that the test criterion has not been met, a detector is dismissed and / or not used for the adjustment of the configuration parameters and / or the adjustment of the configuration parameters for this detector is canceled.

3. Method according to any one of the preceding claims, wherein the configuration of the detectors is optimized as follows: - using protocol lines (P; P1, P2, P3) which have all been created during normal operation of the computer system (1), in particular the normal protocol lines, - evaluating these protocol lines (P; P1, P2, P3) with the detectors, - adjusting the configuration parameters based on the evaluation performed by the detectors, such that a minimum proportion and / or a minimum number of protocol lines (P; P1, P2, P3) is identified as normal or a maximum number of protocol lines is not identified as normal, and / or, if it is not possible to adjust the configuration parameters or if there are no adjustable configuration parameters, removing the respective detector.

4. Method according to any one of the preceding claims, characterized in that at least one detector is configured to detect an abnormal operating state, in that - a key selection parameter is defined in order to select a value from the respective protocol line, - the set of values contained in the specified normal protocol lines and selected by the key selection parameters is determined and defined as a configuration parameter, - wherein a protocol line (P; P1, P2, P3) to be examined is then recognized as an indication of an abnormal operating state in the sense of the detection criterion if the value selected from this protocol line (P; P1, P2, P3) by the key selection parameter is not contained in the determined set.

5. Method according to claim 4, characterized in that for the detector, based on the normal protocol lines as a test criterion, it is checked whether the number of newly occurring different values within the set over time or with an increasing number of normal protocol lines is below a specified threshold value or a specified threshold value function.

6. Method according to claim 5, characterized in that the number of normal protocol lines in the order of their occurrence or the time at which the normal protocol lines (P; P1, P22, P3) are created is divided into a number of sections which preferably have the same duration or comprise the same number of normal protocol lines, - in that for each of these sections of the threshold value function, a proportion or a number of maximum permissible newly occurring different values of the set is specified separately, - in that the newly occurring different values of the set are compared section by section with the values of the threshold function, and if the newly occurring different values exceed the threshold function, the test criterion is not met and / or the detector is dismissed.

7. Method according to any one of the preceding claims, characterized in that, as a test criterion prior to the adjustment of the configuration parameters, it is checked on the basis of the specified normal protocol lines whether, in a number of normal protocol lines exceeding a threshold value or in a proportion of normal protocol lines exceeding a threshold value, values for all the defined key selection parameters are present or assigned to the respective normal protocol line.

8. Method according to any one of the preceding claims, characterized in that at least one detector is configured to detect an abnormal operating state, in that - a key selection parameter is defined for defining a value of the character string type from the respective protocol line, - a number of character frequency values are determined from the character strings contained in the normal protocol lines and defined by the key selection parameters, wherein each of these character frequency values indicates how often a particular character occurs in the respective character string, - a number of character pair frequency values are determined from the character strings contained in the normal protocol lines and defined by the key selection parameters, wherein each of these character pair frequency values indicates how often a specified first character in the respective character string follows a specified second character, then, for each of the specified normal protocol lines - sub-strings each comprising two characters are formed from the value of a normal protocol line to be examined defined by the key selection parameter, - for each of these sub-strings, the quotient of the character pair frequency value for the sub-string and the character frequency value for the first character is formed, and - the mean value for the normal protocol line to be examined is formed from all of these quotients, and a threshold value is determined as a configuration parameter, which corresponds to the minimum of the aforementioned mean values of the individual normal protocol lines, reduced by a specified value if necessary, wherein a protocol line to be examined is checked for the presence of an abnormal operating state in the sense of the detection criterion in that - sub-strings each comprising two characters are formed from the value of a protocol line to be examined (P; P1, P2, P3) defined by the key selection parameter, - for each of these sub-strings, the quotient of the character pair frequency value for the sub-string and the character frequency value for the first character is formed, and - the mean value for the protocol line to be examined (P; P1, P2, P3) is formed from all of these quotients, and - if this mean value is below a specified threshold value, the protocol line (P; P1, P2, P3) to be examined is recognized as an indication of an abnormal operating state in the sense of the detection criterion.

9. Method according to any one of the preceding claims, characterized in that - during the operation of the computer system (1) protocol lines (P; P1, P2, P3) are determined, - the configured detectors examine the protocol lines (P; P1, P2, P3) determined in this way for the presence of an abnormal state, and - an abnormal operating state is detected when at least one of the detectors detects one of the protocol lines (P; P1, P2, P3) as abnormal.

10. Data carrier, on which a program for executing a method according to any one of the preceding patent claims is stored.