Analysis device, analysis program, and analytical method

Abstract

To detect an abnormality by analyzing traffic data of a network with higher efficiency.SOLUTION: The present invention relates to an analysis device for detecting an abnormality of a network by analyzing traffic data generated on a network. Then, the analysis device of the present invention includes: information amount evaluation means of calculating an information amount evaluation value obtained by evaluating an information amount contained in each feature amount constituting the traffic data; and feature amount distribution means of performing selection processing for selecting a feature amount distributed to one or a plurality of detection engines for detecting an abnormality of the network on the basis of a feature amount contained in the traffic data on the basis of the information amount evaluation value calculated by the information amount evaluation means, and acquiring the feature amount selected as a result of the selection processing from the traffic data and distributing them to the detection engines.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an analysis device, an analysis program, and an analysis method, and can be applied to a system that analyzes network traffic data to detect anomalies on the network, for example. [Background technology]

[0002] The threat of cyber attacks is increasing, and the methods are becoming more sophisticated and ingenious. In recent years, with the spread of mobile phone networks, there has been an increase in the number of cases of unauthorized intrusions into organizational networks and information leaks using communication devices that can directly communicate with the Internet. For companies and other organizations, it has become an issue to grasp the actual situation of communication devices connected to the networks of each base and thoroughly manage them.

[0003] For this reason, it is important to monitor communication traffic to understand the actual state of the network and observe events that appear to be abnormal. However, comprehensive observation of the vast amount of event information (that appears to be abnormal) that occurs / changes from moment to moment in communication traffic takes time to detect abnormal events. Here, an event is defined as an abnormal communication pattern, such as an attack that exceeds a threshold in the number of communication flows occurring per unit time.

[0004] A conventional technology for analyzing communication traffic using event information is the system described in Patent Document 1. The system described in Patent Document 1 is configured to compare the analysis results of the acquired communication traffic with previously acquired event information, and detect an abnormality when event information corresponding to the analysis results is present. The system described in Patent Document 1 stores the observed event and stage information of the pre-event stage and post-event stage for multiple events. Furthermore, the system described in Patent Document 1 stores the observed event information as a new event pattern when it does not exist in the stored information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication WO2015 / 128896A1 Summary of the Invention [Problem to be solved by the invention]

[0006] However, the system described in Patent Document 1 has the following two problems.

[0007] The first problem with the system described in Patent Document 1 is that it is difficult to respond to new threats. For example, when an unknown network event occurs in the system described in Patent Document 1, the system needs to store the event, making it difficult to respond to an event that has not been stored.

[0008] A second problem with the system described in Patent Document 1 is the increase in search time. For example, in the system described in Patent Document 1, the more events are stored, the longer the search takes. In order to detect anomalies in a short time in the system described in Patent Document 1, it is necessary to limit the necessary information.

[0009] In view of the above problems, there is a demand for an analysis device, an analysis program, and an analysis method that can more efficiently analyze network traffic data and detect anomalies. [Means for solving the problem]

[0010] The first invention of the present invention is an analysis device that analyzes traffic data generated on a network and detects anomalies in the network, the analysis device comprising: an information amount evaluation means that calculates an information amount evaluation value that evaluates the amount of information contained in each feature that constitutes the traffic data; and a feature distribution means that performs a selection process to select features to be distributed to one or more detection engines that detect anomalies in the network based on the features contained in the traffic data, based on the information amount evaluation value calculated by the information amount evaluation means, and obtains the features selected as a result of the selection process from the traffic data and distributes them to the detection engines.

[0011] The second analysis program of the present invention is characterized in that it causes a computer mounted on an analysis device that analyzes traffic data generated on a network and detects abnormalities in the network to function as an information amount evaluation means that calculates an information amount evaluation value that evaluates the amount of information contained in each feature, and a selection process that selects features to be distributed to one or more detection engines that detect abnormalities in the network based on the features contained in the traffic data based on the information amount evaluation value calculated by the information amount evaluation means, and obtains the features selected as a result of the selection process from the traffic data and distributes them to the detection engines.

[0012] A third aspect of the present invention is an analysis method performed by an analysis device that analyzes traffic data generated on a network and detects anomalies in the network, the analysis device comprising an information amount evaluation means and a feature distribution means, the information amount evaluation means calculates an information amount evaluation value that evaluates the amount of information contained in each feature, the feature distribution means performs a selection process based on the information amount evaluation value calculated by the information amount evaluation means to select features to be distributed to one or more detection engines that detect anomalies in the network based on the features contained in the traffic data, and the feature selected as a result of the selection process is obtained from the traffic data and distributed to the detection engines. Effect of the Invention

[0013] According to the present invention, it is possible to more efficiently analyze network traffic data and detect anomalies. [Brief description of the drawings]

[0014] [Figure 1] FIG. 2 is a block diagram showing the functional configuration of an analysis device according to an embodiment. [Diagram 2] FIG. 2 is a diagram showing the connection relationship of each device according to the embodiment. [Diagram 3] 10 is an explanatory diagram showing traffic data after data shaping processing by a traffic data shaping unit according to the embodiment; FIG. [Figure 4] FIG. 2 is an explanatory diagram showing an example of the configuration of an information amount rank table according to the embodiment; [Diagram 5] FIG. 11 is a diagram illustrating an example of an information amount combination table according to the embodiment. [Figure 6] FIG. 10 is a diagram showing an example of the configuration of an information element table according to the embodiment. [Figure 7] FIG. 4 is a diagram showing an example of the configuration of a feature amount reference table according to the embodiment; [Figure 8] 10 is a flowchart showing an operation of an information selection unit according to the embodiment. [Figure 9] 10 is a flowchart showing an operation of an information distribution unit according to the embodiment. [Figure 10] 13 is a flowchart showing an operation of an information selection unit according to a modified example of the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] (A) Main embodiment DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of an analysis device, an analysis program, and an analysis method according to the present invention will be described below in detail with reference to the drawings. In this embodiment, an example in which the analysis device, the analysis program, and the analysis method according to the present invention are applied to a monitoring device will be described.

[0016] (A-1) Configuration of the embodiment FIG. 2 is a diagram showing the connections of the devices related to this embodiment.

[0017] In this embodiment, the monitoring device 10 will be described as a device that monitors (analyzes) communications in a monitored network 40 (a network to be analyzed). Communication devices 30 (30-1, 30-2, . . . ) are connected to the monitored network 40.

[0018] In the monitored network 40, the network switch 20 is disposed at a position (a position in the network connection configuration) where traffic of each communication device 30 and the like is concentrated, and the monitoring device 10 uses this network switch 20 as an observation point on the monitored network 40 (the interface 21 of the network switch 20 in this embodiment), and analyzes traffic transmitted and received (relayed) by the network switch 20 (interface 21). Here, the data of the packet itself transmitted and received (relayed) by the network switch 20 (interface 21) or the feature quantity of the packet (for example, packet interval time, source port number (source port number), destination port number (destination port number), packet length protocol, etc.) is called "traffic data". Here, the traffic data is supplied to the monitoring device 10 from the network switch 20 having the observation point (for example, supplied by a message in any format or a function of port mirroring, etc.). In other words, in this embodiment, the network switch 20 itself may be used as a means for collecting traffic data and supplying it to the monitoring device 10, but it is not limited to the above configuration and various configurations can be applied.

[0019] In this embodiment, the interface 21 of the network switch 20 is used as an observation point (monitoring point) for collecting traffic data, but the location and number of the observation points are not limited.

[0020] Next, the internal configuration of the monitoring device 10 will be described.

[0021] FIG. 1 is a block diagram showing the functional configuration of a monitoring device 10. As shown in FIG.

[0022] The monitoring device 10 comprises a preprocessing section 11, an information selection processing section 12, an information ranking database 13, and a detection processing section .

[0023] The pre-processing unit 11 acquires traffic data from the network switch 20 and performs processing to shape the acquired traffic data (hereinafter referred to as “data shaping processing”). The pre-processing unit 11 supplies the traffic data after the data shaping processing to the information selection processing unit 12.

[0024] The information selection processing unit 12 performs a process of selecting feature items (information) containing a larger amount of information from the traffic data that has been subjected to data shaping processing (hereinafter referred to as "information selection processing"), and supplies the feature items of the selected items to the detection processing unit 14. In other words, the information selection processing unit 12 selects feature items containing a larger amount of information from the characteristics of the traffic data that change with time. The information selection processing unit 12 performs the information selection processing using an information ranking database 13.

[0025] The information ranking database 13 is a database (storage means) for holding "information-ranked data" in which the amount of information corresponding to each feature item is ranked.

[0026] The detection processing unit 14 detects anomalies on the monitored network 40 based on the traffic data (feature amount) supplied from the information selection processing unit 12. The detection processing unit 14 includes N (N is 2 or more) detection engines 140 (140-1 to 140-N). In the monitoring device 10, it is assumed that an identifier (hereinafter, referred to as an "engine ID") is assigned to each detection engine 140. Here, it is assumed that identifiers 1 to N are assigned to the detection engines 140-1 to 140-N, respectively.

[0027] Each detection engine 140 is a means (for example, a program that performs detection processing) for performing some kind of detection (for example, detection of various abnormalities occurring on the monitored network 40) on the basis of the feature amount of the traffic data supplied thereto. An example of the detection engine 140 is an engine that obtains the number of occurrences of communications per unit time as a feature amount, and detects reconnaissance activities (for example, port scans from an external network, etc.) in the monitored network 40 on the basis of the number of occurrences. Specifically, for example, the detection engine 140 can detect the presence or absence of reconnaissance activities in the network by obtaining "destination port number", "destination address", and "protocol" as feature amounts from the information distribution unit 122. Another example of the detection engine 140 is one that detects unauthorized access to the network by observing unauthorized login attempts. In this case, the detection engine 140 can detect the presence or absence of an unauthorized login attempt (e.g., repeated unauthorized login attempts to any communication device 30) by acquiring, for example, a "destination port number" or a "packet interval time" as feature amounts from the information distribution unit 122. Furthermore, there are no limitations on the method of realizing the detection process in the detection engine 140. For example, the detection engine 140 may perform rule-based (predetermined algorithm) processing, or may perform deep learning-based (e.g., AI such as DNN (Deep Neural Network)).

[0028] Note that, when each detection engine 140 determines that the information (feature items) acquired from the information distribution unit 122 is insufficient, the detection engine 140 may be configured to be able to transmit a request for additional features (hereinafter, simply referred to as an "addition request") to the information distribution unit 122. Each detection engine 140 may request addition by specifically specifying feature items, or may request addition of the number of features without specifying any items.

[0029] Next, the internal configuration of the preprocessing unit 11 will be described.

[0030] The preprocessing unit 11 includes a traffic data acquisition unit 111 , a traffic data formatting unit 112 , and a traffic database 113 .

[0031] The traffic data acquiring unit 111 holds the traffic data from the network switch 20 and supplies it to the traffic data shaping unit 112. There are no limitations on the method by which the traffic data acquiring unit 111 holds the traffic data from the network switch 20, and the traffic data acquiring unit 111 may acquire the traffic data by making a request to the network switch 20, or may simply receive the traffic data transmitted from the network switch 20.

[0032] The traffic data shaping unit 112 performs processing (data shaping processing) for shaping data (for example, normalizing the unit of each item, standardizing the data sequence, etc.) necessary for processing by the information selection processing unit 12 on the traffic data supplied from the traffic data acquisition unit 111. The traffic data shaping unit 112 stores the traffic data after the data shaping processing in the traffic database 113.

[0033] The traffic database 113 is a means for storing and holding traffic data that has undergone data shaping processing.

[0034] FIG. 3 shows an example of the configuration of traffic data after data shaping processing (traffic data stored in the traffic database 113).

[0035] The information selection processing unit 12 of this embodiment will be described as processing traffic data in a format as shown in Fig. 3. The traffic data shown in Fig. 3 is data including features of packet interval time, source port number, destination port number, packet length, and protocol (protocol number) for each time series (time when a packet was acquired). That is, in the traffic data after shaping process shown in Fig. 3, one line shows features (the above five features) corresponding to one packet. The format of the traffic data after shaping process (the number and combination of features, etc.) is not limited, and various formats can be applied.

[0036] The "packet interval time" in the feature of traffic data can be, for example, the time that has elapsed since the packet of interest and the packet immediately before it were acquired. Also, if there is no packet before the packet of interest (the first line, which corresponds to the start of data acquisition), the packet interval time can be set to 0 seconds.

[0037] There may be cases where the traffic data before shaping has a configuration (a configuration different from that of FIG. 3) that cannot be normally processed by the information selection processing unit 12 (for example, when it contains unnecessary data or missing values). Therefore, when the traffic data acquired by the traffic data acquisition unit 111 is not in the format as shown in FIG. 3, the traffic data shaping unit 112 performs a process of shaping the data to the format as shown in FIG. 3. For example, when the traffic data supplied is packet data itself or contains features of unnecessary items or missing values, the traffic data shaping unit 112 shapes the traffic data to the format as shown in FIG. 3 by the shaping process. Note that when traffic data in the format as shown in FIG. 3 is acquired in advance by the traffic data acquisition unit 111, the data shaping process by the traffic data shaping unit 112 may be omitted.

[0038] Next, the internal configuration of the information selection processing unit 12 will be described.

[0039] The information selection processing unit 12 includes an information selection unit 121 , an information distribution unit 122 , and a profile database 123 .

[0040] The information selection unit 121 performs a process (hereinafter referred to as an "information amount evaluation value acquisition process") of calculating and acquiring an evaluation value regarding the information amount of each feature amount of the traffic data acquired from the traffic database 113 (hereinafter referred to as an "information amount evaluation value acquisition process"). The information selection unit 121 registers the information amount evaluation value acquisition process performed on each feature amount of the supplied traffic data in the information ranking database 13 based on the result of the information amount evaluation value acquisition process.

[0041] Although the method by which the information selection unit 121 calculates the information amount evaluation value of each feature is not limited, a method of calculating the information amount evaluation value using a variance value will be described here. However, other statistical values ​​may be used. In traffic data, a feature with a high variance value or the like is considered to have a larger fluctuation and is more likely to indicate an abnormality in the network than a feature with a low variance value. In other words, a feature with a high variance value or the like is more likely to contain a larger amount of information indicating an abnormality in the network than a feature with a low variance value.

[0042] The information selection unit 121 obtains and processes a predetermined amount (a predetermined period) of traffic data from the traffic database 113 as one processing unit. For example, the information selection unit 121 may repeat the operation of obtaining and processing traffic data for a certain time period (e.g., about one minute) from the traffic database 113 as one processing unit, and then obtaining and processing traffic data for the next certain time period as the next time-series processing unit.

[0043] The information distribution unit 122 determines (selects) the feature items to be distributed to each detection engine 140 for each processing unit of traffic data based on the contents of the information ranking database 13 and the profile database 123, and distributes the determined (selected) feature data (data extracted from the traffic data) to each detection engine 140.

[0044] Next, the configuration of the information ranking database 13 will be described.

[0045] The information ranking database 13 includes an information amount rank table 131 and an information amount combination table 132 .

[0046] FIG. 4 is an explanatory diagram showing an example of the configuration of the information amount rank table 131. As shown in FIG.

[0047] In the information amount rank table 131, a value (hereinafter referred to as "information amount rank value") is assigned according to the information amount evaluation value of each feature (item) together with a time (time stamp) indicating a time series for each processing unit of traffic data. FIG. 4 shows an example in which an information amount rank value of 1 to 5 (information amount rank value 1st to 5th) is assigned to five items. Here, the smaller the information amount rank value, the greater the information amount (the higher the rank). For example, in FIG. 4, in the traffic data with the time "2023-3-10 13:01.00", the information amount rank values ​​of 1 to 5 are set for the packet interval time, the source port number, the destination port number, the packet length, and the protocol, respectively. Therefore, in the traffic data with the time "2023-3-10 13:01.00", it is shown that the information amount evaluation value is high (the amount of information is large) in the order of the packet interval time, the source port number, the destination port number, the packet length, and the protocol. The information amount rank value corresponding to the packet interval time is "1", which indicates that this is the feature with the highest information amount evaluation value in this time period (this processing unit).

[0048] The information selection unit 121 registers data in an information amount rank table 131 for each processing unit of traffic data, based on the result of the information amount evaluation value acquisition processing.

[0049] FIG. 5 is a diagram showing an example of the information amount combination table 132. As shown in FIG.

[0050] In the information amount combination table 132, a plurality of combinations (combinations of two or more types of feature quantities) with a large amount of information (four combinations of two types of feature quantities in the example of FIG. 5) are registered for each processing unit of traffic data. In FIG. 5, four combinations (first to fourth combinations) are registered for each processing unit of traffic data together with a time (time stamp) indicating a time series. In the example of FIG. 5, the first to fourth combinations are combinations of feature quantities with higher information amount evaluation values ​​in order. Note that, in this embodiment, for the sake of simplicity of explanation, an example in which four combinations of two types of feature quantities are registered in the information amount combination table 132 is shown, but the number of types of feature quantities to be combined and the number of combinations to be registered are not limited. For example, three combinations of three or more types of feature quantities may be registered in the information amount combination table 132.

[0051] The information selection unit 121 registers data in the information amount combination table 132 based on the result of the information amount evaluation value acquisition process for each processing unit of traffic data. The method of determining each combination in the information amount combination table 132 is not limited, and various methods can be applied.

[0052] For example, the information selection unit 121 may determine each combination according to the information amount rank value of each feature amount. For example, the information selection unit 121 may set a combination of feature amounts having the first and second information amount rank values ​​as a first combination, a combination of feature amounts having the second and third information amount rank values ​​as a second combination, a combination of feature amounts having the third and fourth information amount rank values ​​as a third combination, and a combination of feature amounts having the fourth and fifth information amount rank values ​​as a fourth combination. That is, in this case, the information selection unit 121 may set a feature amount of a combination of feature amounts having the Xth and (X+1)th information amount rank values ​​for the Xth combination.

[0053] Also, the information selection unit 121 may calculate the total value of the information amount for all combinations for each processing unit of traffic data, and register the total value of the information amount in the information amount combination table 132 in descending order of the total value. For example, in this embodiment, since five items of feature amounts are registered in the traffic data, the total number of combinations is 10 (5C2 combinations). Therefore, the information selection unit 121 may calculate the total value of the information amount for all 10 combinations, and set the top four total values ​​as the first to fourth combinations. That is, the information selection unit 121 may calculate the total value of the information amount for all combinations for each processing unit of traffic data, and set the combination with the largest total value as the first combination, the combination with the second largest total value as the second combination, the combination with the third largest total value as the third combination, and the combination with the fourth largest total value as the fourth combination.

[0054] Next, the configuration of the profile database 123 will be described.

[0055] The profile database 123 includes an information element table 1231 and a feature amount reference table 1232 .

[0056] FIG. 6 is a diagram showing an example of the configuration of the information element table 1231. As shown in FIG.

[0057] The information element table 1231 is a table that defines feature amounts that are necessary and unnecessary for detection in the detection engine 140. The information element table 1231 is a table that is referenced by the feature amount reference table 1232.

[0058] 6, the necessity (necessary or unnecessary) of each feature item is set for each engine ID. For example, in FIG. 6, "Packet interval time: necessary, source port number: not necessary, destination port number: necessary, packet length: necessary, protocol: necessary" is set for the detection engine 140-1 with engine ID "1". Therefore, it is defined that the features of the packet interval time, destination port number, packet length, and protocol are necessary among the traffic data for the detection engine 140-1. Note that the information element table 1231 does not need to be set for all the detection engines 140, and may be set for only some of the detection engines 140.

[0059] FIG. 7 is a diagram showing an example of the configuration of the feature amount reference table 1232. As shown in FIG.

[0060] In the feature reference table 1232, "selection method definition information" that defines a method for selecting (determining) a required feature for each engine ID (detection engine 140) is set. The selection method definition information includes information on a reference table (any of the information element table 1231, the information amount rank table 131, or the information amount combination table 132) and reference contents (contents to be referenced from a table set in the reference table). In addition, the feature reference table 1232 shown in FIG. 7 also includes information on the engine type (either rule-based or deep learning-based type) and engine use for each engine ID (detection engine 140), but these items may be excluded.

[0061] 7, for detection engine 140-1 with engine ID "1", "information element" is set in the reference table (when the reference table is "information element", no particular reference content is set). Therefore, when determining the feature to be distributed to detection engine 140-1, information distribution unit 122 refers to the data corresponding to engine ID "1" in information element table 1231 and acquires the feature that is set as necessary.

[0062] Also, in FIG. 7, for the detection engine 140-2 with engine ID "2", "information amount combination" is set in the reference table, and "2 (combination of the first and second)" is set in the reference content. "2" in the reference content indicates the number of combinations of features to be acquired, and "combination of the first and second" in parentheses indicates the combination to be acquired. Therefore, "2 (combination of the first and second)" indicates that the combination of features of the first combination and the second combination is acquired. If it is only necessary to acquire the top combinations, only the number of combinations to be acquired may be set in the reference table "information amount combination". For example, if only "2" is set in the reference content of the reference table "information amount combination", it may indicate that the top two combinations (i.e., the first combination and the second combination) are acquired.

[0063] Furthermore, in FIG. 7, for the detection engine 140-3 with engine ID "3", "information amount rank" is set in the reference table, and "3 (rank 1st, 2nd, 3rd)" is set in the reference content. "3" in the reference content indicates the number of combinations of features to be acquired, and "rank 1st, 2nd, 3rd" in parentheses indicates the information amount rank value of the features to be acquired. Therefore, "3 (rank 1st, 2nd, 3rd)" indicates that three features with information amount rank values ​​1st to 3rd are acquired. If it is only necessary to acquire features with higher information amount rank values, only the number of features to be acquired may be set in the reference table "information amount rank". For example, if only "3" is set in the reference content of the reference table "information amount rank", it may indicate that the three features with the highest information amount rank values ​​(three features with information amount rank values ​​1st to 3rd) are acquired.

[0064] (A-2) Operation of the embodiment Next, the operation of the monitoring device 10 (the analysis method according to the embodiment) will be described.

[0065] FIG. 8 is a flowchart showing the operation of information selection section 121.

[0066] The information selecting unit 121 repeats the process of step S100 shown in Fig. 8 at regular intervals (for each traffic data processing unit). Step S100 includes the processes of steps S101 to S108, which will be described later.

[0067] When the process of step S100 starts, the information selection processing unit 12 first acquires unprocessed traffic data (traffic data for one processing unit) from the traffic database 113 (S101). Hereinafter, the traffic data acquired in step S101 will be referred to as "target traffic data."

[0068] Next, the information selection unit 121 performs a process of normalizing each feature amount of the target traffic data (S102). The specific method of the normalization process performed by the information selection unit 121 is not limited, but for example, each feature amount of the target traffic data may be normalized to a value between 0 and 1. For example, the information selection unit 121 may set the maximum value in each item to 1, and set other values ​​to values ​​corresponding to the maximum value. For example, if the maximum packet length value in the target traffic data is 100 and the minimum packet length value is 10, 100 may be set to 1.0 and 10 to 0.1.

[0069] Next, the information selection unit 121 calculates an average value for each feature amount of the target traffic data after normalization (S103), and further calculates a variance value for each feature amount using the average value (S104).

[0070] The formula for calculating the variance value is not limited, and various formulas can be applied in the information selection unit 121. Here, the variance value is used as an information amount evaluation value, and the larger the variance value of a feature, the higher the information amount rank value.

[0071] Next, the information selection unit 121 compares the variance values ​​for the feature amounts, and assigns information amount rank values ​​in descending order of variance value (S105).

[0072] Next, the information selection unit 121 additionally registers data for the information amount rank value of each feature amount of the target traffic data in the information amount rank table 131 (S106). At this time, the information selection unit 121 may set the time of the data to be set in the information amount rank table 131 to the current time, or may set the time corresponding to any one of the target traffic data (for example, the earliest or latest time).

[0073] Next, the information selection unit 121 additionally registers data in the information amount combination table 132 based on the information amount rank value of each feature amount (the content registered in the information amount rank table 131 in step S106) for the target traffic data (S107). At this time, the information selection unit 121 sets the timestamp of the data to be additionally registered in the information amount combination table 132 to the same time as the data added to the information amount rank table 131. For example, the data in the row of the time "2023-3-10 13:01.00" in the information amount rank table 131 shown in FIG. 4 and the data in the row of the time "2023-3-10 13:01.00" in the information amount combination table 132 shown in FIG. 5 are both data based on the same target traffic data.

[0074] Next, the information selection unit 121 controls the information distribution unit 122 to start a process of distributing the target traffic data to each detection engine 140 of the detection processing unit 14 (hereinafter referred to as a "data distribution process") (S107).

[0075] As described above, the information selecting unit 121 executes the processes of steps S101 to S108 on the target traffic data at regular intervals.

[0076] Next, details of the data distribution process by the information distribution unit 122 will be described with reference to the flowchart of FIG.

[0077] When the information distribution unit 122 starts its operation, it distributes information by executing the process of the flowchart in Fig. 9 for each detection engine 140 (hereinafter referred to as "target detection engine") that is requesting information about the traffic data to be processed. Note that it is assumed here that the information amount rank table 131, information amount combination table 132, information element table 1231, and feature amount reference table 1232 have contents as shown in Figs. 4 to 7, respectively.

[0078] First, it is assumed that the information distribution unit 122 acquires the ID of an arbitrary object detection engine (S201).

[0079] Next, the information distribution unit 122 obtains the selection method definition information (reference table and reference contents) corresponding to the target detection engine from the feature reference table 1232, and checks the setting contents of the reference table (S202). If the reference table is "information element", the information distribution unit 122 proceeds to step S203 described later, if the reference table is "information amount combination", the information distribution unit 122 proceeds to step S204 described later, and if the reference table is "information amount rank table", the information distribution unit 122 proceeds to step S205 described later.

[0080] If the setting content of the reference table is "information element" in step S202, the information distribution unit 122 refers to the data corresponding to the ID of the target detection engine in the information element table 1231, acquires the feature amount set as necessary from the target traffic data (S203), and proceeds to step S206 described below. For example, assume that the ID of the target detection engine is 1 and the content of the information element table 1231 is as shown in Fig. 6. In this case, the information distribution unit 122 acquires the feature amounts of the packet interval time, the destination port number, the packet length, and the protocol from the target traffic data.

[0081] In step S202, if the setting content of the reference table is "information amount combination", the information distribution unit 122 refers to the data corresponding to the ID of the target detection engine in the information amount combination table 132, acquires the feature amount of the combination corresponding to the reference content from the target traffic data (S204), and proceeds to step S206 described later. For example, assume that the ID of the target detection engine is 2. In this case, the reference content corresponding to the target detection engine (ID: 2) is "2 (combination of the first and second)", so the information distribution unit 122 refers to the data corresponding to the target detection engine (ID: 2) in the information amount combination table 132, and acquires the combination corresponding to the reference content "2 (combination of the first and second)". Then, the information distribution unit 122 acquires the feature amount according to the acquired combination from the target traffic data. In this case, assuming that the target traffic data is traffic data for the time "2023-3-10 13:02.00", the first combination corresponding to the target traffic data is "packet length, protocol" and the second combination is "destination port number, packet length", so the information distribution unit 122 will acquire features (packet length, protocol, destination port number, packet length) that cover these two combinations from the traffic data to be processed.

[0082] In step S202, if the setting content of the reference table is "information amount rank", the information distribution unit 122 refers to the data corresponding to the ID of the object detection engine in the information amount rank table 131, acquires the feature amount of the information amount rank value corresponding to the reference content from the object traffic data (S205), and proceeds to step S206 described later. For example, assume that the ID of the object detection engine is 3. In this case, the reference content corresponding to the object detection engine (ID: 3) is "3 (rank 1st, 2nd, 3rd)", so the information distribution unit 122 refers to the data corresponding to the object detection engine (ID: 3) in the information amount rank table 131, and acquires the feature amount item corresponding to the reference content "3 (rank 1st, 2nd, 3rd)". Then, the information distribution unit 122 acquires the feature amount according to the acquired information amount rank value from the object traffic data. In this case, assuming that the target traffic data is traffic data for the time "2023-3-10 13:02.00", three features (protocol, packet length, and destination port number) with information volume rank values ​​1st to 3rd corresponding to the target traffic data will be obtained.

[0083] When the acquisition of features from the target traffic data is completed in any of steps S203 to S205, the information distribution unit 122 checks whether there has been a request for additional features from the target detection engine in the past (S206), and if there has been a request for additional features, the process proceeds to step S207 described below, and if not, the process proceeds to step S208 described below.

[0084] When a feature addition request is received from the target detection engine, the information distribution unit 122 adds the feature requested for addition (the feature acquired from the target traffic data) to the feature acquired in any of the processes in steps S203 to S205, distributes the feature to the detection target engine (S207), and ends the process. At this time, the information distribution unit 122 may make the feature specified by the target detection engine the target of the addition request, or may make one feature with the highest information amount rank value among the feature not acquired in any of the processes in steps S203 to S205 the target of the addition request. The number of features requested to be added by the information distribution unit 122 from the detection processing unit 14 is not limited, and may be more than one. In addition, when the information distribution unit 122 does not accept a feature addition request, the processes in steps S206 and S207 may be omitted, and only step S208 may be executed.

[0085] On the other hand, if there is no feature addition request from the object detection engine, the information distribution unit 122 distributes the feature acquired in any of steps S203 to S205 to the detection object engine (S208), and ends the process.

[0086] (A-3) Effects of the embodiment According to this embodiment, the following effects can be obtained.

[0087] The monitoring device 10 of this embodiment can perform more accurate anomaly detection in the network based on the traffic data by selecting features that contain a larger amount of information from the traffic data and distributing them to each detection engine 140. In other words, the monitoring device 10 of this embodiment can improve the efficiency of anomaly detection (higher accuracy, shorter detection time, etc.) by excluding features that contain a smaller amount of information from the features to be distributed to the detection engines 140.

[0088] In addition, the information distribution unit 122 of the monitoring device 10 in this embodiment can accept requests for adding features from each detection engine 140, thereby enabling optimal feature distribution to be performed taking into account the processing status on the detection engine 140 side.

[0089] (B) Other embodiments The present invention is not limited to the above-described embodiments, and may include modified embodiments such as those exemplified below.

[0090] (B-1) In the above embodiment, a configuration has been described in which the profile data of each detection engine 140 (data in the information element table 1231 and feature reference table 1232) is held in the form of the profile database 123 on the information selection processing unit 12 side, but the data may be held individually on each detection engine 140 side instead of being held on the information selection processing unit 12 side, and transmitted to the information selection processing unit 12 side as necessary. For example, a configuration may be used in which each detection engine 140 transmits (distributes) its own profile data when requesting traffic data (features) from the information selection processing unit 12.

[0091] (B-2) In the above embodiment, a configuration was described in which the monitoring device 10 holds various data in the form of databases (traffic database 113, profile database 123, and information ranking database 13). However, the format in which the monitoring device 10 holds various data is not limited to the database format and may be in various formats (for example, a format in which data is held on a file-by-file basis).

[0092] (B-3) In the above embodiment, the information selection unit 121 has exemplified the method of calculating the information amount evaluation value of each feature amount by using the standard deviation value, variance (variance value), etc., but the information selection unit 121 may also calculate the correlation coefficient between each feature amount of traffic data and use the correlation coefficient as the information amount evaluation value. The method by which the information selection unit 121 calculates the correlation coefficient between each feature amount is not limited, and for example, the correlation coefficient may be calculated using each feature amount constituting the traffic data as a variable. The correlation coefficient can be calculated by dividing the covariance with each of the two feature amounts by the standard deviation of each of the two feature amounts. (Covariance of feature amount 1 and feature amount 2) / (Standard deviation of feature amount 1×Standard deviation of feature amount 2) In the traffic data, the closer the absolute value of the correlation coefficient between the two feature amounts is to 0, the more different the trends of the two feature amounts are. This makes it possible to avoid multicollinearity. From the above, it can be said that two feature amounts whose absolute value is a correlation coefficient close to 0 are highly likely to indicate an abnormality in the monitored network 40. When the correlation coefficient is used as the information amount evaluation value, the correlation between the two feature quantities is smaller and the amount of information is greater as the absolute value of the correlation coefficient approaches 0. Therefore, when the correlation coefficient is used as the information amount evaluation value, the information selection unit 121 evaluates that the closer the correlation coefficient value is to 0, the higher the amount of information (for example, set a higher information amount rank value as the absolute value of the correlation coefficient approaches 0).

[0093] FIG. 10 is a flowchart showing the operation of the information selection unit 121 in the modified embodiment.

[0094] In FIG. 10, steps in which the same operations as those in FIG. 8 are performed are given the same reference numerals (step numbers).

[0095] FIG. 10 differs from FIG. 8 of the above embodiment in that steps S103 to S105 are replaced with steps S304 to S305.

[0096] In steps S303 to S305, the information selection unit 121 calculates a correlation coefficient as an information amount evaluation value for each feature amount, and sets a higher information amount rank value as the correlation coefficient decreases. In Fig. 10, the processes other than steps S303 to S305 are the same as those in Fig. 8 described above, and therefore detailed description thereof will be omitted.

[0097] In the monitoring device 10, even if the correlation coefficient is used as the information amount evaluation value as shown in FIG. 10, the same effect as in the above embodiment can be achieved.

[0098] (B-4) In the above embodiment, the monitoring device 10 itself has the detection processing unit 14, but the monitoring device 10 may not have the detection processing unit 14 and the detection processing unit 14 may be arranged externally. [Explanation of symbols]

[0099] 10... monitoring device, 11... pre-processing unit, 12... information selection processing unit, 13... information ranking database, 14... detection processing unit, 20... network switch, 21... interface, 30... communication device, 40... monitored network, 111... traffic data acquisition unit, 112... traffic data shaping unit, 113... traffic database, 121... information selection unit, 122... information distribution unit, 123... profile database, 131... information amount ranking table, 132... information amount combination table, 140, 140-1 to 140-N... detection engine, 1231... information element table, 1231... information element table, 1232... feature reference table

Claims

1. 1. An analysis device that analyzes traffic data generated on a network to detect an anomaly in the network, an information amount evaluation means for calculating an information amount evaluation value by evaluating the amount of information included in each feature that constitutes the traffic data; a feature distribution means for performing a selection process for selecting features to be distributed to one or more detection engines that detect anomalies in the network based on the features included in the traffic data, based on the information amount evaluation value calculated by the information amount evaluation means, and acquiring the features selected as a result of the selection process from the traffic data and distributing them to the detection engines; An analytical device comprising:

2. 2. The analysis apparatus according to claim 1, wherein the feature distribution means, in the selection process, preferentially selects the feature having a high information amount evaluation value.

3. The analysis device according to claim 2, characterized in that the feature distribution means holds profile data describing a method for selecting the features to be distributed to each of the detection engines, and performs the selection process in accordance with the profile data.

4. 2. The analysis apparatus of claim 1, further comprising a detection processing means comprising one or more of said detection engines.

5. A computer installed in an analysis device that analyzes traffic data generated on a network and detects anomalies in the network, an information amount evaluation means for calculating an information amount evaluation value by evaluating the amount of information included in each of the feature amounts; a feature distribution means for performing a selection process for selecting features to be distributed to one or more detection engines that detect anomalies in the network based on the features included in the traffic data, based on the information amount evaluation value calculated by the information amount evaluation means, and acquiring the features selected as a result of the selection process from the traffic data and distributing them to the detection engines; The present invention relates to an analysis program for performing an analysis.

6. An analysis method performed by an analysis device that analyzes traffic data generated on a network to detect an anomaly in the network, comprising: The analysis device includes an information amount evaluation means and a feature amount distribution means, the information amount evaluation means calculates an information amount evaluation value by evaluating an amount of information included in each of the features; The feature distribution means performs a selection process to select features to be distributed to one or more detection engines that detect anomalies in the network based on the features included in the traffic data, based on the information amount evaluation value calculated by the information amount evaluation means, and acquires the features selected as a result of the selection process from the traffic data and distributes them to the detection engines.

13. An analytical method comprising:

Images