Information processing device, information processing program, and information processing method

Abstract

To enable workability to be improved by simplifying gasping of a communication pattern which a person in charge of managing and maintaining an IT infrastructure has to grasp.SOLUTION: According to the present application, an information processing device includes an extraction part for extracting a transmission source IP address information showing an IP address of a transmission source in a communication log, a transmission destination IP address information showing an IP address of a transmission destination in the communication log, a transmission destination port number information showing a port number of the transmission destination and protocol information showing a protocol type specified by a header part located just after an IP header included in a header area of a packet from the inside of object log information on the basis of an object log information about a communication log in an object apparatus and an object log format showing a description pattern of the object log information, and a generation part for generating first communication pattern information about a communication pattern performed between the transmission source and the transmission destination on the basis of the transmission source IP address information, the transmission destination IP address information, the transmission destination port number information, and the protocol information.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing program, and an information processing method. [Background technology]

[0002] Conventionally, various techniques related to the operation and maintenance of IT infrastructure, which is the foundation of the environment of computers and networks used in organizations such as companies, are known. For example, a communication system including a communication control device and a communication processing device is known, in which the communication processing device includes an analysis unit that analyzes an input packet and extracts at least source information indicating the source of the packet, and a processing unit that executes processing according to a rule according to the analysis result, and the communication control device includes at least a control unit that sets in the processing unit a first rule that executes processing of transmitting a packet and a notification indicating that the packet has been input to the communication control device when the source information extracted from the input packet indicates an unknown source, an extraction unit that extracts source information from a packet received with the notification from the communication processing device, and a storage control unit that stores at least the source information and time information corresponding to the time when the source information was received in a storage unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-61219 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the above-mentioned conventional technologies merely analyze packets, and therefore do not necessarily improve workability by simplifying the understanding of communication patterns that are necessary for personnel who operate and maintain IT infrastructure.

[0005] The present application aims to provide an information processing device, an information processing program, and an information processing method that can improve workability by simplifying the understanding of communication patterns that need to be kept in mind by personnel who operate and maintain IT infrastructure. [Means for solving the problem]

[0006] The information processing device of the present application includes an extraction unit that extracts, from the target log information based on target log information related to a communication log of a target device and a target log format indicating a description pattern of the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating a protocol type identified by a header portion located immediately after an IP header included in a header area of ​​a packet, and a generation unit that generates first communication pattern information related to a communication pattern performed between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information. Effect of the Invention

[0007] According to one aspect of the embodiment, workability can be improved by simplifying the understanding of communication patterns that need to be understood by personnel who operate and maintain IT infrastructure. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an overview of information processing according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of the configuration of the information processing device according to the embodiment. [Diagram 3] FIG. 3 is a flowchart illustrating an example of information processing by the information processing device according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a parameter file according to the embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of device list information according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a log format according to the embodiment. [Figure 7] FIG. 7 is a diagram for explaining the pre-processing according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of subnet list information according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a subnet mask table according to the embodiment. [Figure 10] FIG. 10 is a diagram showing an example of subnet list information to which a start IP address and an end IP address converted into continuous values ​​according to the embodiment have been added. [Figure 11] FIG. 11 is a diagram illustrating an example of basic information according to the embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of communication pattern information according to the embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of communication matrix information between servers according to the embodiment. [Figure 14] FIG. 14 is a diagram showing an example of communication matrix information between a client and a server according to the embodiment. [Figure 15] FIG. 15 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the information processing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, the information processing device, the information processing program, and the information processing method according to the present application (hereinafter, referred to as "embodiments") will be described in detail with reference to the drawings. Note that the information processing device, the information processing program, and the information processing method according to the present application are not limited to the embodiments. In addition, the same components in the following embodiments are given the same reference numerals, and duplicated descriptions will be omitted.

[0010] (Embodiment) [1. Overview of Information Processing] First, an overview of information processing according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an overview of information processing according to an embodiment. Fig. 1 shows an example in which information processing according to an embodiment is executed by an information processing device 100. Fig. 1 also describes a case in which the information processing device 100 provides an analysis result regarding a communication pattern of a communication log of a target device, which is a target device, to a user who operates and maintains an IT infrastructure that is the foundation of a computer and network environment used by a specific organization (for example, a specific company).

[0011] Here, the target device is an information device. For example, the target device is a network device such as a router, a switch, or a firewall. The target device is not limited to a network device, but may be a server such as a Dynamic Host Configuration Protocol (DHCP) server, a proxy server, a Virtual Private Network (VPN) server, or a Domain Name System (DNS) server. The communication log in the target device refers to a record of communication of information transmitted from a sender to a destination via the target device. In the present application, the expressions DHCP server, proxy server, VPN server, DNS server, etc. are used for explanation, but these devices are not limited to servers constructed using a general-purpose server and software, and may include appliance devices. Specifically, for example, a VPN server may be a combination of a general-purpose server and known software such as SoftEther VPN, OpenVPN, or WireGuard. The VPN server may be an appliance product provided by various network vendors. The same may be true for a DHCP server, a proxy server, and a DNS server.

[0012] First, the terminal device 10 of the user transmits a parameter file related to extraction conditions for extracting communication logs in the target device to the information processing device 100. The information processing device 100 acquires the parameter file from the terminal device 10 (step S1). When the information processing device 100 acquires the parameter file, the information processing device 100 transmits a transmission request for target log information related to the communication log in the target device to the log server 200 (step S2). When the log server 200 receives the transmission request for the target log information from the information processing device 100, it transmits the target log information to the information processing device 100. The information processing device 100 acquires the target log information from the log server 200 (step S3). When the information processing device 100 acquires the target log information, the information processing device 100 generates an analysis result related to the communication pattern of the communication log in the target device based on the target log information (step S4). When the information processing device 100 generates the analysis result, the information processing device 100 provides the analysis result to the terminal device 10 (step S5).

[0013] 1, an information processing system 1 according to the embodiment includes a terminal device 10, an information processing device 100, and a log server 200. The terminal device 10, the information processing device 100, and the log server 200 are connected to each other via a network N (not shown) in a wired or wireless manner so as to be able to communicate with each other.

[0014] The terminal device 10 is an information processing device used by a user. The terminal device 10 may be, for example, an information processing device such as a smartphone, a tablet terminal, a desktop PC, a notebook PC, a mobile phone, or a PDA (Personal Digital Assistant). The terminal device 10 transmits a parameter file to the information processing device 100 via a network N.

[0015] The information processing device 100 may be, for example, a personal computer (PC), a work station (WS), a computer having a server function, etc. The information processing device 100 performs processing based on a parameter file transmitted from the terminal device 10 via the network N, for example.

[0016] The log server 200 is a server device that stores log information related to communication logs in all information devices used in a specific organization. The log server 200 collectively manages log information related to communication logs stored in a plurality of servers provided in a plurality of bases (also called sites) in a specific organization. Specifically, the log server 200 stores log information in a firewall, a DHCP server, a proxy server, a VPN server, a DNS server, or the like. For example, the log server 200 stores log information in a specific file format for each piece of information such as a host name corresponding to an information device, an IP address corresponding to an information device, and a date and time when a communication log in an information device was generated. Hereinafter, a file containing log information may be referred to as a log file.

[0017] When storing log information, the log server 200 may compress the log file in any compression format such as ZIP format, tape archives (TAR) format, GZIP format, etc. In this way, the log file can be stored while reducing the amount of resources of the log server 200. Note that a file obtained by compressing a log file may be referred to as a compressed file.

[0018] The network N connects the terminal device 10, the information processing device 100, and the log server 200 in a wired or wireless manner so that they can communicate with each other. If the network N is wired, it may be realized by Ethernet (registered trademark) defined in IEEE802.3. If the network N is wireless, it may be realized by a wireless LAN (Local Area Network) defined in IEEE802.11.

[0019] 2. Configuration of Information Processing Device An example of the configuration of the information processing device 100 according to the embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the configuration of the information processing device 100 according to the embodiment. The information processing device 100 has a communication unit 110, a storage unit 120, and a control unit 130.

[0020] (Communication unit 110) The communication unit 110 is realized by a NIC (Network Interface Card), an antenna, etc. The communication unit 110 is connected to various networks by wire or wirelessly, and transmits and receives information to and from the terminal device 10 and the log server 200, for example.

[0021] (Storage unit 120) The storage unit 120 is realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. Specifically, the storage unit 120 stores various data. For example, the storage unit 120 stores device list information, a log format, subnet list information, a subnet mask table, and subnet list information to which a start IP address and an end IP address converted into continuous values ​​are added. The storage unit 120 also stores various programs. For example, the storage unit 120 stores an information processing program according to the embodiment.

[0022] (Control unit 130) The control unit 130 is a controller, and is realized, for example, by a CPU (Central Processing Unit), MPU (Micro Processing Unit), etc., executing various programs stored in a storage device inside the information processing device 100 using a RAM as a working area. The control unit 130 is also a controller, and is realized, for example, by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0023] The control unit 130 has an acquisition unit 131, an extraction unit 132, an identification unit 133, a generation unit 134, and a provision unit 135 as functional units, and may realize or execute the information processing action described below. The internal configuration of the control unit 130 is not limited to the configuration shown in Fig. 2, and may be other configurations as long as they perform the information processing described below. Furthermore, each functional unit indicates a function of the control unit 130, and does not necessarily have to be physically distinct.

[0024] (Acquisition part 131) The acquisition unit 131 acquires various information. Specifically, the acquisition unit 131 acquires a parameter file from the terminal device 10. Furthermore, when the acquisition unit 131 acquires the parameter file, the acquisition unit 131 transmits a transmission request for target log information related to a communication log in a target device to the log server 200. Furthermore, the acquisition unit 131 acquires the target log information from the log server 200.

[0025] (Extraction part 132) The extraction unit 132 extracts various information. Specifically, the extraction unit 132 extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating the protocol type (for example, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), etc. may be used) specified by the header portion located immediately after the IP header included in the header area of ​​the packet transmitted and received between the information devices via the network N, based on the target log information related to the communication log in the target device acquired by the acquisition unit 131 and the target log format indicating the description pattern of the target log information. In this disclosure, for convenience of explanation, the above protocols may be expressed as protocols in the transport layer. Here, the transport layer refers to the fourth layer in the OSI reference model and the third layer in the TCP / IP model, and refers to a layer that provides a communication management function in the network. Note that Internet Control Message Protocol (ICMP) and ICMP for IPv6 (ICMPv6) are generally considered to be protocols belonging to the network layer in the OSI reference model and the internet layer in the TCP / IP model, but since they are higher-level protocols than Internet Protocol (IP) and may be processed in firewall devices and the like in the same way as transport layer protocols, in this disclosure they will be described as being included in the transport layer protocols.

[0026] (Specific Section 133) The identification unit 133 identifies various information. Specifically, the identification unit 133 calculates start IP address information indicating a start IP address with the smallest numerical value among the multiple IP addresses included in each of the multiple subnet addresses, and end IP address information indicating an end IP address with the largest numerical value included in the IP address. Next, the identification unit 133 identifies target subnet address information indicating a target subnet address corresponding to the target IP address based on whether or not a target IP address exists among the IP addresses between the start IP address and the end IP address. For example, the identification unit 133 identifies source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address.

[0027] (Generation unit 134) The generating unit 134 generates various information. Specifically, the generating unit 134 generates an analysis result regarding the communication pattern of the communication log in the target device based on the target log information acquired by the acquiring unit 131. More specifically, the generating unit 134 generates basic information regarding the communication pattern performed between the source and destination based on the source IP address information, destination IP address information, destination port number information, and protocol information extracted by the extracting unit 132.

[0028] (Provider 135) The providing unit 135 provides various information. Specifically, the providing unit 135 provides the analysis result generated by the generating unit 134 to the terminal device 10. More specifically, the providing unit 135 transmits the analysis result to the terminal device 10. For example, the providing unit 135 transmits first communication pattern information to the terminal device 10 as an example of the analysis result.

[0029] Next, an example of information processing by the information processing device 100 according to the embodiment will be described with reference to Fig. 3. Fig. 3 is a flowchart showing an example of information processing by the information processing device according to the embodiment. In Fig. 3, the acquisition unit 131 acquires a parameter file from the terminal device 10 (step S101). The parameter file is information including an IP address and a host name corresponding to a target device.

[0030] An example of the parameter file 121 according to the embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the parameter file 121 according to the embodiment. In the example shown in Fig. 4, the parameter file 121 includes information on items such as "IP address", "log format identification information", "host name", "target date From", and "target date To".

[0031] The parameter file may be a data file in a Comma Separated Values ​​(CSV) format, a Tab Separated Values ​​(TSV) format, etc. The parameter file may be binary data in a text format, a JavaScript (registered trademark) Object Notation (JSON) format, etc.

[0032] "IP address" indicates an IP address corresponding to the target device. "Log format identification information" indicates identification information for identifying a target log format indicating a description pattern of a communication log in the target device. Specifically, for example, the log format identification information may be information indicating the type of the target device, such as a router, a firewall, a DNS server, a proxy server, etc. In addition, even if the device is of the same type, the output log format may be different depending on the manufacturer, the system version, the setting status, etc. In addition, even if the device is of a different type, a common log format may be used depending on the manufacturer, the system version, the setting status, etc. Therefore, for example, the log format identification information may be information for identifying devices having the same log format. "Host name" indicates a host name corresponding to the target device. "Target date From" indicates the start date of the period in which the log to be analyzed was generated. "Target date To" indicates the end date of the period in which the log to be analyzed was generated.

[0033] Furthermore, when the acquiring unit 131 acquires the parameter file, it acquires device list information by referring to the storage unit 120. The device list information is information in which the IP addresses, host names, information indicating the storage locations of communication logs, and log format identification information corresponding to all information devices used in a specific organization are associated with each other.

[0034] An example of device list information 122 according to an embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of device list information 122 according to an embodiment. In the example shown in Fig. 5, the device list information 122 includes information on items such as "IP address", "device identification information", "host name", "log storage path", and "log format identification information".

[0035] "IP address" indicates an IP address corresponding to each of all information devices used in a specified organization. "Device identification information" indicates identification information for identifying the type of device corresponding to each of all information devices used in a specified organization. "Host name" indicates a host name corresponding to each of all information devices used in a specified organization. "Log storage path" indicates a storage location of log information related to communication logs in each of all information devices used in a specified organization. Specifically, "log storage path" indicates a storage location of log information in log server 200. Note that, in a case where multiple log servers 200 are installed, information for identifying the log server 200 that stores the log information of the device may be included. "Log format identification information" indicates identification information for identifying a log format indicating a description pattern of communication logs in each of all information devices used in a specified organization.

[0036] Furthermore, when the acquisition unit 131 acquires the parameter file and the device list information, the acquisition unit 131 collates the IP address and the host name corresponding to the target device included in the parameter file with the IP addresses and the host names corresponding to each of all the information devices included in the device list information to identify the storage location of the target log information related to the communication log of the target device. Furthermore, when the acquisition unit 131 identifies the storage location of the target log information, the acquisition unit 131 transmits a transmission request for the target log information stored in the identified storage location to the log server 200. Furthermore, the acquisition unit 131 acquires the target log information from the log server 200 (step S102). Specifically, the acquisition unit 131 acquires a log file including the target log information. For example, the acquisition unit 131 acquires the log file based on any file transfer protocol such as File Transfer Protocol (FTP), Secure FTP (SFTP), or Secure Copy Protocol (SCP). Furthermore, when the acquisition unit 131 acquires a compressed file as the log file, the acquisition unit 131 decompresses the compressed file and acquires the log file (step S103). Furthermore, the acquisition unit 131 acquires the target log information from the log file.

[0037] Furthermore, when the acquisition unit 131 acquires the target log information, it refers to the storage unit 120 and acquires a log format indicating a description pattern of the log information corresponding to each of the multiple different information devices. The acquisition unit 131 acquires multiple different log formats corresponding to each of the multiple different information devices. The log format is information in which an extraction target indicating information to be extracted from a log corresponding to an information device is associated with identification information identifying a log format corresponding to the information device. When the acquisition unit 131 acquires multiple different log formats, it refers to identification information identifying each of the multiple different log formats and identification information identifying a target log format included in a parameter file, and identifies a target log format indicating a description pattern of the target log information from among the multiple different log formats. When the acquisition unit 131 identifies the target log format, it acquires the identified target log format from among the acquired multiple different log formats.

[0038] Here, due to circumstances such as a change in the settings of an information device or an update in the software version, a log in a certain format may be deleted or the format of an existing log may be changed. In this case, the log format may not be correctly recognized until the log format is corrected, which may cause problems in the analysis of the communication log. However, it is difficult for an administrator who manages a huge number of information devices to instantly reflect the change in the system for all of the information devices to be managed. Therefore, the acquisition unit 131 may notify the administrator when the target log information does not correspond to any log format or when the occurrence frequency of a specific log format has changed. Specifically, the acquisition unit 131 may record how many times each log format has been processed within a unit time (for example, one day), and may notify the administrator when the number of times the log format has been processed has increased or decreased by a predetermined ratio compared to the number of times the log format has been processed in the past. In addition, the acquisition unit 131 may notify the administrator when the target log information is 0, and may notify the administrator of the target log information when the target log information does not match any format.

[0039] An example of a log format according to the embodiment will be described with reference to FIG. 6. FIG. 6 is a diagram showing an example of a log format according to the embodiment. FIG. 6 shows a log format showing a description pattern of log information corresponding to two types of firewalls (part 1) and (part 2) from different vendors, a log format showing a description pattern of log information corresponding to DHCP, a log format showing a description pattern of log information corresponding to a proxy, a log format showing a description pattern of log information corresponding to a VPN, and a log format showing a description pattern of log information corresponding to DNS. The extraction target shown in FIG. 6 indicates information to be extracted from each log format. For example, the extraction target is source IP address information showing the IP address of the source in the communication log, destination IP address information showing the IP address of the destination in the communication log, and destination port number information showing the port number of the destination. As shown in FIG. 6, the log format of an information device is not uniform.

[0040] Furthermore, when the acquisition unit 131 acquires the target log information and the target log format, the extraction unit 132 extracts information corresponding to the extraction target in the target log format from the target log information, based on the target log format and the target log information acquired by the acquisition unit 131. Specifically, the extraction unit 132 extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, and destination port number information indicating the port number of the destination.

[0041] Furthermore, the acquisition unit 131 performs pre-processing based on the subnet list information and the subnet mask table (step S105). The subnet list information is a list of addresses (hereinafter, may be referred to as "subnet addresses") corresponding to all subnetworks used in a specific organization. The subnet mask table is a table that associates mask lengths, mask values, the number of IP addresses, and the result of dividing the number of IP addresses by 256.

[0042] FIG. 7 is a diagram for explaining the pre-processing according to the embodiment. In FIG. 7, the acquisition unit 131 acquires one subnet address indicated by, for example, "XX.X.120.0 / 22" from the subnet list information. The acquisition unit 131 specifies, as the start IP address, "XX.X.120.0" which has the smallest numerical value among 256 IP addresses included in the subnet corresponding to "XX.X.120.0" before "22" indicating the mask length in the acquired subnet address "XX.X.120.0 / 22". When the acquisition unit 131 specifies "XX.X.120.0" as the start IP address, it converts "XX.X.120.0" to "XXXXXX120000", which is a continuous value. Specifically, the acquisition unit 131 converts each of the numbers separated by "." (hereinafter, each number will be referred to as an "octet") in "XX.X.120.0," namely "XX," "X," "120," and "0," into three-digit numbers "XXX," "XXX," "120," and "000," respectively, and then generates the continuous value "XXXXXX120000" with the "." removed.

[0043] Furthermore, the acquiring unit 131 refers to the subnet mask table and acquires the mask value "255.255.252.0" corresponding to the mask length "22" of the acquired subnet address, the number of IP addresses "1024", and the value "4" obtained by dividing the number of IP addresses by 256. Since the value of the third octet of the mask value "255.255.252.0" is "252" which is less than "255", the acquiring unit 131 identifies the third octet of the acquired subnet address as the target octet. Furthermore, when the acquiring unit 131 identifies the third octet as the target octet, it counts up the target octet based on the value "4" obtained by dividing the number of IP addresses by 256. Specifically, the acquisition unit 131 calculates "XX.X.120.0", "XX.X.121.0", "XX.X.122.0", and "XX.X.123.0" by increasing the value of the third octet by "4" including "XX.X.120.0" identified as the start IP address. Furthermore, the acquisition unit 131 identifies "XX.X.123.255", which has the largest numerical value included in the IP address, as the end IP address out of 256 IP addresses included in the subnetwork corresponding to "XX.X.123.0", which has the largest third octet value among "XX.X.120.0", "XX.X.121.0", "XX.X.122.0", and "XX.X.123.0". When the acquisition unit 131 identifies "XX.X.123.255" as the end IP address, it converts "XX.X.123.255" to the consecutive value "XXXXXX123255." Specifically, the acquisition unit 131 converts the numbers "XX," "X," "123," and "255" separated by "." in "XX.X.123.255" to three-digit numbers "XXX," "XXX," "123," and "255," respectively, and then generates the consecutive value "XXXXXX123255" with the "." removed.

[0044] In this way, for each of all subnet addresses included in the subnetwork list information, the acquisition unit 131 calculates a start IP address with the smallest numerical value included in the IP address and an end IP address with the largest numerical value included in the IP address among a plurality of IP addresses included in the subnetwork corresponding to the subnetwork address. When the acquisition unit 131 calculates the start IP address and the end IP address, the acquisition unit 131 generates start IP address information (corresponding to the start IP address converted into the continuous value described above) indicating the start IP address and end IP address information (corresponding to the end IP address converted into the continuous value described above) indicating the end IP address. When the acquisition unit 131 generates the start IP address information (corresponding to the start IP address converted into the continuous value described above) and the end IP address information (corresponding to the end IP address converted into the continuous value described above), the acquisition unit 131 generates subnetwork list information in which the start IP address information (corresponding to the start IP address converted into the continuous value described above) and the end IP address information (corresponding to the end IP address converted into the continuous value described above) are added to the subnetwork list information.

[0045] An example of subnet list information 123 according to an embodiment will be described with reference to Fig. 8. Fig. 8 is a diagram showing an example of subnet list information 123 according to an embodiment. In the example shown in Fig. 8, subnet list information 123 includes information on items such as "network address", "bit mask", "subnet", "category ID", and "category".

[0046] "Network address" indicates the address corresponding to the network part of the subnet address. "Bit mask" indicates the mask length of the subnet. "Subnet" indicates the address corresponding to the subnetwork (also called the subnet address). "Category ID" indicates identification information that identifies the category of the subnetwork. "Category" indicates the category of the subnetwork.

[0047] In this embodiment, a category refers to category information (information such as a tag) indicating a category previously associated with a sub-network by a user who operates and maintains the IT infrastructure. Specifically, the category information may be information indicating the use of the sub-network. For example, the category information may be information indicating that the use corresponds to a cloud database, information indicating that the use corresponds to management, etc.

[0048] An example of the subnet mask table 124 according to the embodiment will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the subnet mask table 124 according to the embodiment. In the example shown in Fig. 9, the subnet mask table 124 includes information on items such as "mask length", "mask value", "number of IPs", and "result of division by 256".

[0049] "Mask length" indicates the mask length of the subnet mask. "Mask value" indicates the mask value of the subnet mask. "Number of IPs" indicates the number of IP addresses contained in the subnetwork corresponding to the subnet mask. "Result of division by 256" indicates the number of IP addresses contained in the subnetwork corresponding to the subnet mask divided by 256.

[0050] An example of subnet list information 125 to which a start IP address and an end IP address converted into continuous values ​​according to an embodiment have been added will be described with reference to FIG. 10. FIG. 10 is a diagram showing an example of subnet list information 125 to which a start IP address and an end IP address converted into continuous values ​​according to an embodiment have been added. Subnet list information 125 shown in FIG. 10 is obtained by adding information on items such as "start IP address" and "end IP address" to subnet list information 123 shown in FIG. 8. "Start IP address" indicates a value obtained by converting a start IP address in a subnetwork corresponding to a subnet address into a continuous value. "End IP address" indicates a value obtained by converting an end IP address in a subnetwork corresponding to a subnet address into a continuous value.

[0051] Furthermore, when the source IP address information, the destination IP address information, and the destination port number information are extracted by the extraction unit 132, the identification unit 133 identifies the source subnetwork address information indicating the subnetwork address corresponding to the source IP address and the destination subnetwork address information indicating the subnetwork address corresponding to the destination IP address (step S106). Specifically, the identification unit 133 converts the source IP address into a continuous value based on the source IP address information. When the identification unit 133 converts the source IP address into a continuous value, the identification unit 133 refers to the subnetwork list information 125 to which the start IP address and the end IP address converted into the continuous value are added, and determines whether the source IP address is present within the range of the IP address between the start IP address and the end IP address corresponding to each of the multiple subnet addresses. When the identification unit 133 determines that the source IP address is present within the range of the IP address between the start IP address and the end IP address, it identifies the subnetwork address that is the subject of the determination as the source subnetwork address, which is the subnetwork address corresponding to the source IP address. Similarly, when the destination IP address is converted into a continuous value, the identifying unit 133 refers to the subnetwork list information 125 to which the start IP address and end IP address converted into continuous values ​​are added, and determines whether the destination IP address is present within the range of the IP address between the start IP address and the end IP address corresponding to each of the multiple subnetwork addresses. When the identifying unit 133 determines that the destination IP address is present within the range of the IP address between the start IP address and the end IP address, it identifies the determined subnetwork address as the destination subnetwork address, which is the subnetwork address corresponding to the destination IP address.

[0052] Furthermore, the generating unit 134 generates basic information including the source IP address information, destination IP address information, destination port number information, and protocol information extracted by the extracting unit 132, based on the source IP address information, destination IP address information, destination port number information, and protocol information extracted by the extracting unit 132. Furthermore, the generating unit 134 generates basic information regarding a communication pattern performed between the source and the destination. Specifically, the generating unit 134 generates basic information including the number of communications performed between the source and the destination. That is, the generating unit 134 generates communication pattern information including the number of communications performed between the source information device and the destination information device. Furthermore, the generating unit 134 generates basic information including the source subnetwork address information and destination subnetwork address information identified by the identifying unit 133, based on the source subnetwork address information and destination subnetwork address information identified by the identifying unit 133 (step S107). Furthermore, the generating unit 134 generates basic information including source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork.

[0053] An example of the basic information 126 according to the embodiment will be described with reference to Fig. 11. Fig. 11 is a diagram showing an example of the basic information 126 according to the embodiment. In the example shown in Fig. 11, the basic information 126 includes information on items such as "protocol", "source IP address", "source network address", "source bit mask", "source category", "destination IP address", "destination network address", "destination bit mask", "destination category", "destination port number", and "number of items".

[0054] "Protocol" indicates a communication protocol. "Source IP address" indicates the IP address of the sender. "Source network address" indicates the subnet address corresponding to the source IP address (hereinafter, may be referred to as "source subnet address"). "Source bit mask" indicates the mask length of the subnet mask corresponding to the source subnet address. "Source category" indicates the category of the sender. "Destination IP address" indicates the IP address of the destination. "Destination network address" indicates the subnet address corresponding to the destination IP address (hereinafter, may be referred to as "destination subnet address"). "Destination bit mask" indicates the mask length of the subnet mask corresponding to the destination subnet address. "Destination category" indicates the category of the destination. "Destination port number" indicates the port number of the destination. "Number of cases" indicates the number (number of times) of communications performed between the source information device and the destination information device. Specifically, "number of cases" indicates the number of communications included in the log generated between "Target date From" and "Target date To" included in the parameter file 121.

[0055] Furthermore, the generating unit 134 generates communication pattern information regarding a communication pattern between a source subnetwork and a destination subnetwork for each subnetwork address based on the basic information. Specifically, the generating unit 134 generates communication pattern information including the number of communications between the source subnetwork and the destination subnetwork for each subnetwork address based on the source subnetwork address information and the destination subnetwork address information included in the basic information. That is, the generating unit 134 generates communication pattern information including the number of communications between the source subnetwork and the destination subnetwork.

[0056] An example of the communication pattern information 127 according to the embodiment will be described with reference to Fig. 12. Fig. 12 is a diagram showing an example of the communication pattern information 127 according to the embodiment. In the example shown in Fig. 12, the communication pattern information 127 includes information on items such as "source segment", "source bit mask", "destination segment", "destination bit mask", "destination port number", and "number of items".

[0057] "Source segment" indicates the source subnetwork. Specifically, "source segment" is the source subnetwork address. "Source bit mask" indicates the mask length of the subnetwork corresponding to the source subnetwork address. "Destination segment" indicates the destination subnetwork. Specifically, "destination segment" is the destination subnetwork address. "Destination bit mask" indicates the mask length of the subnetwork corresponding to the destination subnetwork address. "Destination port number" indicates the destination port number. "Number of instances" indicates the number of communications (times) that took place between the source subnetwork and the destination subnetwork.

[0058] Furthermore, when generating the basic information, the generating unit 134 generates matrix information on a category-by-category communication pattern between the source sub-network and the destination sub-network based on the basic information. Specifically, the generating unit 134 generates inter-server communication matrix information on a category-by-category communication pattern between the sub-network to which the source server belongs and the sub-network to which the destination server belongs. More specifically, the generating unit 134 generates inter-server communication matrix information including information based on the number of category-by-category communications between the sub-network to which the source server belongs and the sub-network to which the destination server belongs based on the source IP address information and source category information and destination IP address information and destination category information included in the basic information.

[0059] An example of the inter-server communication matrix information 128 according to the embodiment will be described with reference to FIG. 13. FIG. 13 is a diagram showing an example of the inter-server communication matrix information 128 according to the embodiment. Although not shown in FIG. 13, the generation unit 134 displays the number of communications between the sub-network to which the source server belongs and the sub-network to which the destination server belongs in each cell of the inter-server communication matrix information 128. In addition, the generation unit 134 visually highlights and displays a cell in which communication between sub-networks not permitted as a communication pattern has occurred. For example, the generation unit 134 displays a cell in which communication between sub-networks not permitted as a communication pattern has occurred by filling it in red.

[0060] 13, the inter-server communication matrix information 128 includes information on major categories such as "Source" and "Destination." Furthermore, "Source" and "Destination" further include information on medium categories such as "Group Name" and "Category Name." Furthermore, "Group Name" and "Category Name" further include information on minor categories such as "Development," "Internal," "DMZ," "Shared," and "Internet."

[0061] "Source" indicates the source of transmission. "Destination" indicates the destination of transmission. "Group name" indicates the name of the group corresponding to the subnetwork to which the source server or destination server belongs. "Category name" indicates the name of the category corresponding to the subnetwork to which the source server or destination server belongs. "Development" indicates the subnetwork to which servers for system development belong. "Internal" indicates the subnetwork to which servers that can only connect to networks within an organization belong. "Demilitarized Zone (DMZ)" indicates the subnetwork to which DMZ servers belong. "Shared" indicates the subnetwork to which servers that can connect to a shared network within an organization belong. "Internet" indicates the subnetwork to which servers that can connect to the Internet belong.

[0062] Furthermore, the generating unit 134 generates client-server communication matrix information relating to a category-based communication pattern between a sub-network to which the source client belongs and a sub-network to which the destination server belongs. More specifically, the generating unit 134 generates client-server communication matrix information including information based on the number of category-based communications between the source client and the destination server based on the source IP address information and source category information, and the destination IP address information and destination category information included in the basic information.

[0063] An example of the client-server communication matrix information 129 according to the embodiment will be described with reference to FIG. 14. FIG. 14 is a diagram showing an example of the client-server communication matrix information 129 according to the embodiment. Although not shown in FIG. 14, the generation unit 134 displays the number of communications between the sub-network to which the source client belongs and the sub-network to which the destination server belongs in each cell of the client-server communication matrix information 129. In addition, the generation unit 134 visually highlights and displays a cell in which communication between sub-networks not permitted as a communication pattern has occurred. For example, the generation unit 134 displays a cell in which communication between sub-networks not permitted as a communication pattern has occurred by filling it in red.

[0064] In the example shown in Fig. 14, the client-server communication matrix information 129 includes information on major categories such as "Source" and "Destination." Furthermore, "Source" and "Destination" further include information on medium categories such as "group name" and "category name." Furthermore, the "group name" and "category name" corresponding to "Source" further include information on minor categories such as "development terminal," "normal terminal," "high security terminal," and "external terminal." Furthermore, the "group name" and "category name" corresponding to "Destination" further include information on minor categories such as "development," "internal," "DMZ," "shared," and "Internet."

[0065] "Source" indicates the source of the message. Furthermore, the "group name" corresponding to "Source" indicates the name of the group corresponding to the source client. Furthermore, the "category name" corresponding to "Source" indicates the name of the category corresponding to the source client. "Development terminal" indicates a terminal used for development. "Normal terminal" indicates a normal terminal. "High security terminal" indicates a terminal with high security. "External terminal" indicates a terminal outside the company. "Destination" indicates the destination of the message. Furthermore, the "group name" corresponding to "Destination" indicates the name of the group corresponding to the destination server. Furthermore, the "category name" corresponding to "Source" indicates the name of the category corresponding to the destination server. "Development" indicates a server for system development. "Internal" indicates a server that can only be connected to an internal network of the organization. "DMZ" indicates a server for DMZ. "Shared" indicates a server that can be connected to a shared network within the organization. "Internet" indicates a server that can be connected to the Internet.

[0066] 3. Effects As described above, the information processing device 100 according to the embodiment includes the extraction unit 132 and the generation unit 134. The extraction unit 132 extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating the protocol type specified by the header portion located immediately after the IP header included in the header area of ​​the packet, based on the source IP address information, destination IP address information, destination port number information, and protocol information. The generation unit 134 generates first communication pattern information regarding the communication pattern performed between the source and destination, based on the source IP address information, destination IP address information, destination port number information, and protocol information.

[0067] This allows the information processing device 100 to analyze communication logs in various information devices more quickly and flexibly. Therefore, the information processing device 100 can improve workability by simplifying the understanding of communication patterns that need to be understood by personnel in charge of operating and maintaining IT infrastructure. In addition, the information processing device 100 can easily identify the scope of impact of setting changes and the like in the operation and maintenance of IT infrastructure, thereby contributing to the achievement of Goal 9 of the Sustainable Development Goals (SDGs) "Build resilient infrastructure, promote inclusive and sustainable industrialization and innovation" and Goal 12 of the Sustainable Development Goals (SDGs) "Responsible Consumption and Production."

[0068] The information processing device 100 further includes a specification unit 133. The specification unit 133 calculates start IP address information indicating a start IP address with a minimum value included in the IP address and end IP address information indicating an end IP address with a maximum value included in the IP address among the multiple IP addresses included in each of the multiple subnet addresses, and specifies target subnet address information indicating a target subnet address corresponding to the target IP address based on whether or not the target IP address exists among the IP addresses between the start IP address and the end IP address. The specification unit 133 also specifies source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address. The generation unit 134 generates first communication pattern information including the source subnet address information and the destination subnet address information.

[0069] This enables the information processing apparatus 100 to improve the convenience when defining a policy for each subnetwork, for example.

[0070] Furthermore, the generating unit 134 generates second communication pattern information on the communication pattern for each subnetwork address performed between the source subnetwork and the destination subnetwork, based on the first communication pattern information.

[0071] This enables the information processing apparatus 100 to improve the convenience when defining a policy for each subnetwork.

[0072] In addition, the generation unit 134 generates first communication pattern information including source category information indicating a category corresponding to a source subnetwork and destination category information indicating a category corresponding to a destination subnetwork, and generates third communication pattern information regarding a category-based communication pattern performed between the source subnetwork and the destination subnetwork based on the generated first communication pattern information.

[0073] Thereby, when there is communication between sub-networks that is not permitted as a communication pattern, the information processing device 100 can close the port.

[0074] Furthermore, the generating unit 134 generates third communication pattern information regarding a communication pattern for each category performed between the sub-network to which the source server belongs and the sub-network to which the destination server belongs.

[0075] Thereby, when there is communication between sub-networks that is not permitted as a communication pattern, the information processing device 100 can close the port.

[0076] Furthermore, the generating unit 134 generates third communication pattern information regarding a communication pattern for each category performed between the sub-network to which the source client belongs and the sub-network to which the destination server belongs.

[0077] Thereby, when there is communication between sub-networks that is not permitted as a communication pattern, the information processing device 100 can close the port.

[0078] [4. Hardware Configuration] Moreover, the information processing device 100 according to the embodiment described above is realized by a computer 1000 having a configuration as shown in Fig. 15, for example. Fig. 15 is a hardware configuration diagram showing an example of a computer that realizes the functions of the information processing device 100. The computer 1000 includes a CPU 1100, a RAM 1200, a ROM 1300, a HDD 1400, a communication interface (I / F) 1500, an input / output interface (I / F) 1600, and a media interface (I / F) 1700.

[0079] The CPU 1100 operates and controls each unit based on a program stored in the ROM 1300 or the HDD 1400. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started up, programs that depend on the hardware of the computer 1000, and the like.

[0080] The HDD 1400 stores programs executed by the CPU 1100, data used by such programs, etc. The communication interface 1500 receives data from other devices via a predetermined communication network and sends it to the CPU 1100, and transmits data generated by the CPU 1100 to other devices via the predetermined communication network.

[0081] The CPU 1100 controls output devices such as a display and a printer, and input devices such as a keyboard and a mouse, via the input / output interface 1600. The CPU 1100 acquires data from the input devices via the input / output interface 1600. The CPU 1100 also outputs generated data to the output devices via the input / output interface 1600.

[0082] The media interface 1700 reads a program or data stored in the recording medium 1800 and provides it to the CPU 1100 via the RAM 1200. The CPU 1100 loads the program from the recording medium 1800 onto the RAM 1200 via the media interface 1700 and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable Disc), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory.

[0083] For example, when the computer 1000 functions as the information processing device 100 according to the embodiment, the CPU 1100 of the computer 1000 executes programs loaded onto the RAM 1200 to realize the functions of the control unit 130. The CPU 1100 of the computer 1000 reads and executes these programs from the recording medium 1800, but as another example, the CPU 1100 may obtain these programs from another device via a predetermined communication network.

[0084] Although some of the embodiments of the present application have been described in detail above with reference to the drawings, these are merely examples, and the present invention can be embodied in other forms that incorporate various modifications and improvements based on the knowledge of those skilled in the art, including the forms described in the Disclosure of the Invention section.

[0085] [5. Other] Furthermore, among the processes described in the above embodiments and modifications, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified. For example, the various information shown in each drawing is not limited to the illustrated information.

[0086] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc.

[0087] Furthermore, the above-described embodiments and modifications can be appropriately combined as long as the processing contents are not contradictory. [Explanation of symbols]

[0088] 1. Information Processing Systems 10 Terminal Equipment 200 Log Server 100 Information processing device 110 Communications Department 120 Storage section 130 Control section 131 Acquisition Department 132 Extraction part 133 Specific part 134 Generation part 135 Provision Department

Claims

1. an extraction unit that extracts, from the target log information, source IP address information indicating a source IP address in the communication log, destination IP address information indicating a destination IP address in the communication log, destination port number information indicating a port number of the destination, and protocol information indicating a protocol type specified by a header portion located immediately after an IP header included in a header area of ​​a packet, based on target log information related to a communication log in a target device and a target log format indicating a description pattern of the target log information; a generating unit that generates first communication pattern information regarding a communication pattern between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information; An information processing device comprising:

2. a specifying unit that calculates starting IP address information indicating a starting IP address having a smallest numerical value among a plurality of IP addresses included in each of a plurality of subnet addresses and ending IP address information indicating an ending IP address having a largest numerical value among a plurality of IP addresses included in each of a plurality of subnet addresses, and specifies target subnet address information indicating a target subnet address corresponding to the target IP address based on whether a target IP address exists among the IP addresses between the starting IP address and the ending IP address; The identification unit is Identifying source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address; The generation unit is generating the first communication pattern information including the source subnet address information and the destination subnet address information; The information processing device according to claim 1 .

3. The generation unit is generating second communication pattern information relating to a communication pattern for each subnet address performed between the source subnetwork and the destination subnetwork based on the first communication pattern information; The information processing device according to claim 2 .

4. The generation unit is generating the first communication pattern information including source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork, and generating third communication pattern information regarding a category-based communication pattern performed between the source subnetwork and the destination subnetwork based on the generated first communication pattern information; The information processing device according to claim 2 .

5. The generation unit is generating the third communication pattern information regarding a communication pattern for each category performed between a sub-network to which the source server belongs and a sub-network to which the destination server belongs; The information processing device according to claim 4.

6. The generation unit is generating the third communication pattern information regarding a communication pattern for each category performed between a sub-network to which the source client belongs and a sub-network to which the destination server belongs; The information processing device according to claim 4.

7. an extraction step of extracting, from the target log information, source IP address information indicating a source IP address in the communication log, destination IP address information indicating a destination IP address in the communication log, destination port number information indicating a port number of the destination, and protocol information indicating a protocol type specified by a header portion located immediately after an IP header included in a header area of ​​a packet, based on target log information related to a communication log in a target device and a target log format indicating a description pattern of the target log information; a generating step of generating first communication pattern information regarding a communication pattern performed between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information; An information processing program that causes a computer to execute the above.

8. An information processing method implemented by a program executed by an information processing device, comprising: an extraction step of extracting, from the target log information, source IP address information indicating a source IP address in the communication log, destination IP address information indicating a destination IP address in the communication log, destination port number information indicating a port number of the destination, and protocol information indicating a protocol type specified by a header portion located immediately after an IP header included in a header area of ​​a packet, based on target log information related to a communication log in a target device and a target log format indicating a description pattern of the target log information; a generating step of generating first communication pattern information regarding a communication pattern performed between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information; An information processing method comprising:

Images