Monitoring device, monitoring program and monitoring method

Abstract

To automatically acquire, upon connecting to an unknown network, one or more appropriate parameters in an environment of the connected network.SOLUTION: Provided is a monitoring device. The monitoring device comprises: abnormality detection means which analyzes communication data generated on a network, performs detection processing for detecting an abnormality of the network and outputs a detection result; threshold hold means which holds one or more thresholds used for the detection processing; parameter hold means which holds one or more parameters used for calculating some of or all the one or more thresholds; and calculation means which calculates some of or all the one or more thresholds held by the threshold hold means or some of or all the one or more parameters held by the parameter hold means on the basis of the communication data or the detection result.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a monitoring device, a monitoring program, and a monitoring method, and can be applied to, for example, a system that analyzes communication data of a network to detect abnormalities on the network.

Background Art

[0002] Conventionally, for security monitoring on a network, there is a monitoring device that collects and analyzes packet data flowing through the network. As conventional monitoring devices, there are the devices described in Patent Documents 1 and 2.

[0003] The device described in Patent Document 1 monitors packets on a control network without changing the programs of the devices constituting the network in taking security measures for an infrastructure control system. Specifically, the device described in Patent Document 1 has an estimation unit that learns the feature amounts of packets by a predetermined learning algorithm and generates parameters for determining whether the packets are normal or abnormal, and a verification instruction unit that determines whether to update the parameters. Thereby, the device described in Patent Document 1 can realize abnormality detection with suppressed false detection without requiring knowledge of communication data or detailed specifications of the control system. Further, in the device described in Patent Document 1, when a false detection occurs, it is possible to suppress a decrease in detection accuracy by not adding the falsely detected packets to the learning data.

[0004] The device described in Patent Document 2 efficiently and accurately feeds back a small amount of over-detection data to highly accurately evaluate the presence or absence of abnormality in communication data. In the device described in Patent Document 2, when it is noticed that over-detection has occurred, the over-detection data is fed back to improve the detection accuracy. Specifically, the device described in Patent Document 2 determines the presence or absence of abnormality in evaluation data using a learning data model that has learned normal data and an over-detection model that has learned over-detection data, and combines the estimation results of the two models to perform the evaluation, thereby highly accurately executing the evaluation of the presence or absence of abnormality in communication data.

Prior Art Documents

Patent Document

[0005]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] However, when the monitoring devices described in Patent Documents 1 and 2 are connected to an unknown network, they do not automatically adjust the parameters of the monitoring device according to the connected network environment to obtain appropriate detection accuracy.

[0007] Therefore, there is a need for a monitoring device, a monitoring program, and a monitoring method that can automatically acquire appropriate parameters in the connected network environment when connected to an unknown network.

Means for Solving the Problems

[0008] The monitoring device according to the first aspect of the present invention includes an abnormality detection unit that performs detection processing for analyzing communication data generated on a network to detect an abnormality in the network and outputs a detection result, a threshold holding unit that holds a threshold used in the detection processing, a parameter holding unit that holds one or more parameters used when obtaining part or all of the thresholds, and a calculation unit that calculates based on the communication data and / or the detection result for part or all of the thresholds held by the threshold holding unit and / or part or all of the parameters held by the parameter holding unit.

[0009] The monitoring program according to the second aspect of the present invention performs detection processing for analyzing communication data generated on a network to detect an abnormality in the network, and outputs a detection result. The monitoring program includes an abnormality detection unit, a threshold holding unit that holds a threshold value used in the detection processing, a parameter holding unit that holds one or more parameters used when obtaining part or all of the threshold values, and a calculation unit that functions to calculate part or all of the threshold values held by the threshold holding unit and / or part or all of the parameters held by the parameter holding unit based on the communication data and / or the detection result.

[0010] According to a third aspect of the present invention, in a monitoring method performed by a monitoring device, the monitoring device includes an abnormality detection unit, a parameter holding unit, and a calculation unit. The abnormality detection unit performs detection processing for analyzing communication data generated on a network to detect an abnormality in the network, and outputs a detection result. The threshold holding unit holds a threshold value used in the detection processing. The parameter holding unit holds one or more parameters used when obtaining part or all of the threshold values. The calculation unit calculates part or all of the threshold values held by the threshold holding unit and / or part or all of the parameters held by the parameter holding unit based on the communication data and / or the detection result.

Advantages of the Invention

[0011] According to this invention, it is possible to provide a monitoring device, a monitoring program, and a monitoring method that automatically acquire appropriate parameters in the connected network environment when connecting to an unknown network.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Embodiments for Carrying Out the Invention

[0013] (A) First Embodiment Hereinafter, a first embodiment of a monitoring device, a monitoring program, and a monitoring method according to the present invention will be described in detail with reference to the drawings.

[0014] (A-1) Configuration of the First Embodiment FIG. 2 is a diagram showing the connection relationships of the respective devices related to this embodiment.

[0015] In FIG. 2, the reference numerals in parentheses are used only in the second embodiment described later.

[0016] In this embodiment, the monitoring device 10 will be described as a device that monitors (analyzes) the communication of the monitoring target network 40 (the network to be analyzed). The communication devices 30 (30-1, 30-2, ···) to be monitored are connected to the monitoring target network 40. Note that the number of communication devices 30 to be monitored is not limited.

[0017] In the monitoring target network 40, a network switch 20 is arranged at a position (position in the network connection configuration) where the traffic of each communication device 30 and the like converges. The monitoring device 10 regards this network switch 20 as an observation point on the monitoring target network 40 (in the example of this embodiment, the interface 21 of the network switch 20), and analyzes the communication (traffic) transmitted and received (relayed) by the network switch 20 (interface 21) based on feature amounts. Here, a set of feature amounts (for example, packet interval time, source port number (transmission source port number), destination port number (destination port number), packet length protocol, etc.) of the packet sequence transmitted and received (relayed) by the network switch 20 (interface 21) (a set of feature amounts for each communication device 30) is called "communication data". Here, the data of the packet sequence itself is supplied from the network switch 20 having the observation point to the monitoring device 10 (for example, supplied by a port mirroring function or the like), and the data of the packet sequence is converted into communication data by the monitoring device 10. However, the monitoring device 10 may be configured to acquire the communication data itself from the outside.

[0018] Note that in this embodiment, the interface 21 of the network switch 20 is applied as an observation point (monitoring point) for collecting communication data, but the position and number of the observation points are not limited.

[0019] Next, the internal configuration of the monitoring device 10 will be described.

[0020] FIG. 1 is a block diagram showing the functional configuration of the monitoring device 10. In FIG. 1, the reference numerals in parentheses are used only in the second embodiment described later.

[0021] The monitoring device 10 includes a detection engine unit 11, a temporary storage unit 12, and an environmental adaptation adjustment unit 13.

[0022] The monitoring device 10 may be configured, for example, by installing a program (including the monitoring program according to the embodiment) in a computer including a processor and a memory.

[0023] First, the detailed configuration of the detection engine unit 11 will be described.

[0024] The detection engine unit 11 is a means (for example, a program for performing detection processing) for performing processing of detecting something related to the monitoring target network 40 (for example, detecting various abnormalities occurring on the monitoring target network 40) based on the feature amount of communication data supplied from the network switch 20 (hereinafter, simply referred to as "detection processing"). The detection engine unit 11 includes a communication data acquisition unit 111, an individual threshold calculation unit 112, and an abnormality detection unit 113.

[0025] The communication data acquisition unit 111 is responsible for the function of acquiring communication data based on the data of the packet sequence supplied from the network switch 20.

[0026] The abnormality detection unit 113 is responsible for the function of performing detection processing on the communication data acquired by the communication data acquisition unit 111 for one or more items (viewpoints) and outputting the detection result. Various abnormality detection processes (abnormality detection processes in network security) can be applied to the detection process performed by the abnormality detection unit 113.

[0027] Here, the abnormality detection unit 113 shall use one or more threshold values (for example, a threshold value for determining whether the feature amount deviates from the steady state range) in the detection process. Also, in this embodiment, among the threshold values used in the detection process of the abnormality detection unit 113, there are a threshold value set for each communication device 30 (for example, for each IP address to be monitored) (hereinafter referred to as "individual threshold value") and a threshold value that is a common value for the whole (the entire communication device 30 to be monitored) (hereinafter referred to as "overall threshold value"). Note that the number (types) of the individual threshold values and the overall threshold values used in the abnormality detection unit 113 are not limited to one or more. The individual threshold value is, for example, a threshold value set based on the feature amount and the past communication performance of each communication device 30. The overall threshold value is, for example, a threshold value applied as an initial value when the individual threshold value cannot be calculated due to insufficient data or the like for a certain communication device 30. Also, the threshold value used in the abnormality detection unit 113 may be either the overall threshold value or the individual threshold value. Furthermore, each threshold value used in the detection process of this embodiment shall also include a dynamically changing threshold value (hereinafter also referred to as "dynamic threshold value"). The abnormality detection unit 113 acquires the threshold values (individual threshold values and overall threshold values) from the temporary storage unit 12 and applies them to the detection process.

[0028] The individual threshold value calculation unit 112 performs individual threshold value calculation processing (processing for calculating each of the individual threshold values that are dynamic threshold values) for each communication device 30 (for example, for each IP address to be monitored) used by the abnormality detection unit 113. Although the details will be described later, in the individual threshold value calculation unit 112, one or more parameters (hereinafter simply referred to as "parameters") shall be used in the individual threshold value calculation process. The individual threshold value calculation unit 112 acquires the parameters (threshold value adjustment parameters) from the temporary storage unit 12 and applies them to the individual threshold value calculation process.

[0029] Next, the detailed configuration of the temporary storage unit 12 will be described.

[0030] The temporary storage unit 12 is responsible for the function of storing various parameters, detection results, etc. used in the processing of the detection engine unit 11. The temporary storage unit 12 has a communication data storage unit 121, a parameter storage unit 122, a threshold value storage unit 123, and a detection result storage unit 124.

[0031] The communication data storage unit 121 is responsible for the function of accumulating the communication data acquired by the communication data acquisition unit 111.

[0032] The parameter storage unit 122 is responsible for the function of holding parameters. The parameter storage unit 122 holds the parameters supplied from the environment adaptation adjustment unit 13 and supplies them to the detection engine unit 11 (individual threshold value calculation unit 112). When the latest parameters are supplied from the environment adaptation adjustment unit 13, the parameter storage unit 122 updates the held parameters to the latest values.

[0033] The threshold value storage unit 123 is responsible for the function of storing each threshold value (individual threshold value and overall threshold value).

[0034] The threshold value storage unit 123 has an individual threshold value storage unit 1231 that stores individual threshold values and an overall threshold value storage unit 1232 that stores overall threshold values.

[0035] The individual threshold value storage unit 1231 holds the individual threshold values (individual threshold values for each combination of the communication device 30 and the detection item) supplied from the individual threshold value calculation unit 112 and supplies them to the abnormality detection unit 113. When the latest individual threshold values are supplied from the individual threshold value calculation unit 112, the individual threshold value storage unit 1231 updates the held individual threshold values to the latest values.

[0036] The overall threshold value storage unit 1232 holds the overall threshold values supplied from the environment adaptation adjustment unit 13 and supplies them to the abnormality detection unit 113. When the latest overall threshold values are supplied from the environment adaptation adjustment unit 13, the overall threshold value storage unit 1232 updates the held individual threshold values to the latest values.

[0037] The detection result storage unit 124 is responsible for the function of accumulating the detection results by the abnormality detection unit 113.

[0038] Next, the detailed configuration of the environment adaptation adjustment unit 13 will be described.

[0039] The environment adaptation adjustment unit 13 is responsible for calculating and adjusting parameters and the like. The environment adaptation adjustment unit 13 includes a parameter adjustment unit 131 and an overall threshold adjustment unit 132.

[0040] The parameter adjustment unit 131 performs a process of calculating parameters (hereinafter referred to as "parameter calculation process") based on detection results, communication data, etc., and performs a process of adjusting the parameters by setting them in the parameter storage unit 122 (hereinafter referred to as "parameter adjustment process"). The parameter adjustment unit 131 holds a parameter table 1311 and a combination table 1312 as data for calculating parameters.

[0041] The overall threshold adjustment unit 132 performs a process of calculating an overall threshold (hereinafter referred to as "overall threshold calculation process") based on the communication data held in the communication data storage unit 121, and performs a process of adjusting the calculated overall threshold by setting it in the overall threshold adjustment unit 132 (hereinafter referred to as "overall threshold adjustment process").

[0042] Next, an example of the parameters processed by the monitoring device 10 (parameters acquired by the parameter adjustment unit 131 and held by the parameter adjustment unit 131) will be described.

[0043] FIG. 3 is a diagram showing in tabular form a list of parameters stored in the parameter storage unit 122.

[0044] As shown in FIG. 3, in the monitoring device 10 of this embodiment, it will be described that parameters related to three items, namely, "intensity X of outlier removal", "constant a of the threshold calculation formula", and "constant b of the threshold calculation formula", are processed. Note that the number and combination of parameters processed by the monitoring device 10 of this embodiment are not limited to these, and various combinations can be applied.

[0045] The outlier removal intensity X is a value expressed as the occurrence probability [%] for the intensity (range) to be regarded as an outlier when calculating a threshold value for removing outliers for samples of a certain feature amount (hereinafter referred to as the "target feature amount"). For example, when the outlier removal intensity X = 90%, it means that a threshold value for excluding 10% of the samples of the target feature amount as outliers is determined. For example, when the outlier removal intensity X = 90%, in the individual threshold value calculation process, the threshold value for removing the top 10% of the samples of the target feature amount in descending order of the values may be calculated as outliers. That is, it shows that the larger the outlier removal intensity X, the larger the ratio of the number of samples excluded as outliers from the samples of the target feature amount X (the stronger the outlier removal intensity), and a threshold value is calculated.

[0046] The constants a and b in the threshold value calculation formula are assumed to represent constants (for example, coefficients used in threshold value calculation, etc.) arbitrarily used for any threshold value calculation in the individual threshold value calculation process. The specific nature and functions of the constants a and b in the threshold value calculation formula are not limited, and constant values in various threshold value calculations can be set.

[0047] Next, the processing outline of the parameter adjustment unit 131 will be described.

[0048] As described above, the parameter adjustment unit 131 calculates and adjusts each parameter based on communication data, etc. within a predetermined period. The parameter adjustment unit 131 calculates the values of new parameters within the range according to the description in the parameter table 1311.

[0049] FIG. 4 is a diagram showing a configuration example of the parameter table 1311.

[0050] As shown in FIG. 4, in the parameter table 1311, the default value, upper limit value, and lower limit value of each parameter are set. That is, initially, the parameter adjustment unit 131 sets the default value for each parameter (stores it in the parameter storage unit 122), and then based on communication data, etc. within a predetermined period, performs processing to adjust the value of each parameter within the range of the upper limit value and the lower limit value.

[0051] In FIG. 4, for the outlier removal intensity X, "default value = 95, upper limit value = 99, lower limit value = 90", for the constant a in the threshold calculation formula, "default value = 4, upper limit value = 5, lower limit value = 3", and for the constant b in the threshold calculation formula, "default value = 10, upper limit value = 50, lower limit value = 3".

[0052] Here, it is assumed that each parameter (X, a, b) is a discrete value (i.e., an integer value). Then, here, the possible values of the outlier removal intensity X are 10 (90 - 99), the possible values of the constant a in the threshold calculation formula are 3 (3 - 5), and the possible values of the constant b in the threshold calculation formula are 48 (3 - 50). Therefore, here, the number of combinations of the values of each parameter is 1440 (= 10 × 3 × 48).

[0053] FIG. 5 is a diagram showing a configuration example of the combination table 1312.

[0054] As shown in FIG. 5, in the combination table 1312, for all combinations when setting parameters according to the parameter table 1311, they are described for each "combination number" as an identifier. That is, as shown in FIG. 5, the combination table 1312 describes 1440 combinations of parameters.

[0055] In FIG. 5, an example is shown where for combination number 1, a combination (X = 90, a = 3, b = 3) in which all parameters are at their lower limit values is described, and for combination number 1440, a combination (X = 99, a = 5, b = 50) in which all parameters are at their upper limit values is described. The order of combinations in combination table 1312 is not limited, and various orders can be applied (for example, all combinations corresponding to combination number 1 may be set to default values).

[0056] (A-2) Operation of the First Embodiment Next, the operation of the monitoring device 10 of this embodiment (monitoring method according to the embodiment) will be described.

[0057] FIG. 6 is a flowchart showing the operation when the monitoring device 10 starts connecting to the monitored network 40.

[0058] In the flowchart of FIG. 6, n is a variable for counting the passage of a period (hereinafter referred to as "initial adjustment period N") during which the monitoring device 10 performs processing for adapting to the environment (hereinafter referred to as "environment adaptation processing"). The initial adjustment period N is not limited and may be, for example, 7 (7 days).

[0059] First, it is assumed that the monitoring device 10 is newly connected to the network 40 to be monitored (network switch 20) (S101), and the detection engine unit 11 starts operating (S102). At this time, the environment adaptation adjustment unit 13 initializes the variable n to 0 (n = n + 1) in order to start counting the initial adjustment period (S103). At this time, it is assumed that an initial value based on the default value of each parameter (the default value in the parameter storage unit 122) is set in the individual threshold storage unit 1231 by the individual threshold calculation unit 112. Also, at this time, it is assumed that an initial value (for example, a predetermined value set in advance) is set in the overall threshold storage unit 1232 by the overall threshold adjustment unit 132. Further, at this time, the communication data acquisition unit 111 supplies the communication data supplied from the network switch 20 to the communication data storage unit 121 for storage. Thereafter, the abnormality detection unit 113 starts detection processing using each threshold value held in the threshold storage unit 123 (individual threshold storage unit 1231 and overall threshold storage unit 1232) for the communication data held in the communication data storage unit 121. The result of the detection processing performed by the abnormality detection unit 113 will be stored in the detection result storage unit 124.

[0060] Next, after waiting for 24 hours (one day), the environment adaptation adjustment unit 13 increments the variable n (n = n + 1) (S104). Note that the waiting period at this time is not limited to 24 hours (one day), and various times can be applied.

[0061] Next, the environment adaptation adjustment unit 13 acquires the communication data and detection results for the past n days (n × waiting period) from the communication data storage unit 121 and the detection result storage unit 124 (S105).

[0062] Next, the environment adaptation adjustment unit 13 (parameter adjustment unit 131) performs parameter calculation processing based on the acquired communication data and detection results for the past n days (S106). The details of the parameter calculation processing will be described later.

[0063] At this time, the environment adaptation adjustment unit 13 (the overall threshold adjustment unit 132) also performs an overall threshold calculation process based on the communication data for the past n days and the like (S107).

[0064] Next, the environment adaptation adjustment unit 13 (the parameter adjustment unit 131 and the overall threshold adjustment unit 132) sets and adjusts the calculated parameters in the parameter storage unit 122, and further sets and adjusts the calculated overall threshold in the overall threshold storage unit 1232 (S108).

[0065] Next, the environment adaptation adjustment unit 13 checks whether the variable n is greater than the initial adjustment period N (n > N) (S109). If the variable n is greater than N, it is determined that the initial adjustment period N has elapsed, and the environment application process ends. Otherwise, it returns to step S104 above to continue the environment application process.

[0066] Next, the detailed operation of the detection engine unit 11 will be described.

[0067] FIG. 7 is a flowchart showing the operation of the detection engine unit 11 (the processes in steps 102 and the like described above).

[0068] When the detection engine unit 11 starts operating, the communication data acquisition unit 111 continues to acquire the communication data supplied from the network switch 20 and accumulate it in the communication data storage unit 121 (S201).

[0069] At this time, the individual threshold calculation unit 112 also continues to perform an individual threshold calculation process based on the communication data supplied from the communication data acquisition unit 111 and update the individual threshold in the individual threshold storage unit 1231 to the calculated individual threshold (S202).

[0070] At this time, the abnormality detection unit 113 also continues to input the communication data supplied from the communication data acquisition unit 111 and the thresholds (individual threshold and overall threshold) in the threshold storage unit 123, perform a detection process to obtain a detection result, and supply the detection result to the detection result storage unit 124 (S203).

[0071] The detection engine unit 11 checks whether operation stop is necessary (for example, whether operation stop is necessary based on an operator's operation or various events) (S204). If it is to stop operation, all the above processes are terminated. If operation is to continue (operation stop is not necessary), the process returns to step S201 above to continue the operation.

[0072] Next, the detailed operation of the parameter adjustment unit 131 will be described.

[0073] FIG. 8 is a flowchart showing the operation of the parameter adjustment unit 131 (the process of step S106 above).

[0074] In FIG. 8, k is a variable indicating the position (index represented by the combination number; row number) when the parameter adjustment unit 131 acquires data (parameter combination) from the combination table 1312.

[0075] When starting operation, the parameter adjustment unit 131 acquires the detection results for a predetermined past period (for example, about the past 7 days) (the detection results accumulated in the detection result storage unit 124) and the information of the combination table 1312 (S301). Note that the parameter adjustment unit 131 may set the information generated in advance based on the parameter table 1311 in the combination table 1312.

[0076] Next, the parameter adjustment unit 131 sets the variable k to the initial value 1 (k = 1) (S302).

[0077] Next, the parameter adjustment unit 131 acquires the information (parameter combination) of the combination number k from the combination table 1312, inputs the acquired parameter combination (the parameter combination of the combination number k) to the individual threshold value storage unit 1231, executes the individual threshold value calculation process, and associates and holds the calculated individual threshold value with the holding combination number (parameter combination).

[0078] Next, the parameter adjustment unit 131 increments the variable k (k = k + 1) (S305), determines whether k is greater than the number of rows in the combination table 1312 (the maximum combination number) (S306), and if k is greater than the number of rows in the combination table 1312, proceeds to step S307 described below; otherwise, returns to the process of step S303 above and operates.

[0079] When k is greater than the number of rows in the combination table 1312 (the maximum combination number), the parameter adjustment unit 131 performs a process of evaluating the individual thresholds obtained for each combination number (parameter combination) (hereinafter referred to as "parameter evaluation process"), and determines the combination number (parameter combination) with the highest evaluation. Then, the parameter adjustment unit 131 acquires the combination of parameters with the highest evaluation value from the combination table 1312, adopts the acquired combination of parameters (obtained as the result of the parameter calculation process) (S307), and ends the process.

[0080] Here, the details of the parameter evaluation process performed by the parameter adjustment unit 131 will be described.

[0081] The parameter adjustment unit 131 may perform the parameter evaluation process for the parameter combination based on, for example, the number of samples detected as abnormal (hereinafter referred to as "abnormal detection number").

[0082] By the way, generally, in a network security monitoring device, when detecting an abnormality based on a statistical value or the like, if the number of abnormal detections is too large, it will interfere with management (for example, confirmation by a security administrator), and if the number of abnormal detections is too small, the possibility of not being able to detect a serious abnormality even if it occurs increases. That is, in a network security monitoring device, it is desirable for security management that the threshold value is adjusted so that an appropriate number of abnormal detections occur during normal operation.

[0083] Therefore, here, the parameter adjustment unit 131 shall evaluate more highly the combination of parameters such that the number of anomaly detections per day is M for each item (perspective) of anomaly detection during the parameter evaluation process. That is, the parameter adjustment unit 131 shall evaluate more highly the combination of parameters closer to M cases in terms of the number of anomaly detections per day for each item (perspective) of anomaly detection during the parameter evaluation process. When there are multiple items of anomaly detection performed by the anomaly detection unit 113, the parameter adjustment unit 131 may assign a higher evaluation to the combination of parameters for which the average value of the number of anomaly detections for each item is closer to M cases. The value of M applied to the parameter evaluation process is not limited, but for example, it may be about 5 cases.

[0084] Next, the overall threshold adjustment unit 132's overall threshold calculation process will be described.

[0085] FIG. 9 is a flowchart showing the operation of the overall threshold adjustment unit 132 (the process of step S107 described above).

[0086] When starting the overall threshold calculation process, the overall threshold adjustment unit 132 first acquires communication data for a predetermined period (S401), and for each item of the feature amount constituting the acquired communication data, uses a kernel density estimation function (probability density estimation model) to perform a process of estimating the probability density (distribution of probability density) of each value of the feature amount (hereinafter referred to as "probability density estimation process") (S402).

[0087] Then, the overall threshold adjustment unit 132 calculates the overall threshold based on the result of the probability density estimation process (distribution of probability density) acquired for each item of the feature amount, sets it in the overall threshold storage unit 1232 (S403), and ends the process.

[0088] Next, an example of overall threshold calculation by the overall threshold storage unit 1232 will be described.

[0089] FIG. 10 is an explanatory diagram showing the process by which the overall threshold adjustment unit 132 calculates the overall threshold based on the estimated distribution of probability density.

[0090] Figure 10(a) is a graph showing the distribution of the number of data for each sample value of the feature quantity of interest (the feature quantity of a certain item). In Figure 10(a), the horizontal axis represents the value and the vertical axis represents the number of data of the sample value, and it is a bar graph (a graph of discrete values). Figure 10(b) shows the result of the probability density estimation process when the distribution of the feature quantity of interest is in the state shown in Figure 10(a).

[0091] In Figure 10(b), the distribution of the probability density is shown by being divided into a region A1 in the steady range less than the threshold Th and a region A2 of outliers greater than or equal to the threshold Th. Here, let the integral value (area) of the region A1 in the steady range be V1 and the integral value (area) of the region A2 of outliers be V2. At this time, the overall threshold adjustment unit 132 shall adopt, as the overall threshold of the feature quantity of interest, a threshold Th such that V1 and V2 are in a predetermined ratio (proportion). For example, the overall threshold adjustment unit 132 may adopt, as the overall threshold of the feature quantity of interest, a threshold Th for which V1 = 0.99 and V2 = 0.01.

[0092] Note that in the above, the overall threshold adjustment unit 132 uses kernel density estimation as an example of a method of statistically analyzing the occurrence probability from past performance (communication data) and calculating a threshold value that can represent the steady range, but other methods may be applied.

[0093] Next, the individual threshold calculation process by the individual threshold calculation unit 112 will be described.

[0094] Figure 11 is a flowchart showing the operation of the overall threshold adjustment unit 132 (the processes such as step S202 described above).

[0095] When starting the individual threshold calculation process, the individual threshold calculation unit 112 first takes as input the communication data for a predetermined period and parameters (parameters stored in the parameter storage unit 122), calculates the individual threshold of the communication device 30 corresponding to the communication data (S501), supplies the calculated individual threshold to the individual threshold storage unit 1231 for storage (S502), and ends the process.

[0096] (A-3) Effects of the First Embodiment According to the first embodiment, the following effects can be achieved.

[0097] In the monitoring device 10 of the first embodiment, when connecting to the monitored network 40, by performing environment adaptation processing, the overall threshold and parameters are optimized (adapted to the monitored network 40). Therefore, when connecting to an unknown network, appropriate parameters and thresholds in the connected network environment can be automatically obtained.

[0098] Furthermore, in the monitoring device 10 of the first embodiment, as the thresholds used by the detection engine unit 11 (anomaly detection unit 113) for detection processing, having two types of thresholds, an overall threshold and an individual threshold, enables more accurate anomaly detection. For example, when a large amount of communication data is generated, an individual threshold can be calculated and applied for each communication device 30 to be monitored, and in an environment where communication data is insufficient, the overall threshold calculated for the entire monitored network 40 can be uniformly applied.

[0099] (B) Second Embodiment Hereinafter, a second embodiment of the monitoring device, monitoring program, and monitoring method according to the present invention will be described in detail with reference to the drawings.

[0100] (B-1) Configuration of the Second Embodiment The overall configuration of the second embodiment and the monitoring device 10A of the second embodiment can also be shown using FIGS. 1 and 2 described above. Note that the reference numerals in parentheses in FIGS. 1 and 2 are reference numerals used only in the second embodiment.

[0101] As shown in FIG. 1, the monitoring device 10A of the second embodiment is different from the first embodiment in that the environment adaptation adjustment unit 13 is replaced by an environment adaptation adjustment unit 13A. Further, the environment adaptation adjustment unit 13A of the second embodiment is different from the first embodiment in that the parameter adjustment unit 131 and the overall threshold adjustment unit 132 are replaced by a parameter adjustment unit 131A and an overall threshold adjustment unit 132A.

[0102] In the first embodiment, the environment adaptation process is performed only at the initial connection of the monitoring device 10. However, the monitoring device 10A in the second embodiment is different in that the environment adaptation process is also periodically performed at timings other than the initial connection.

[0103] (B-2) Operation of the Second Embodiment The environment adaptation adjustment unit 13A (parameter adjustment unit 131A and overall threshold adjustment unit 132A) of the second embodiment performs the environment adaptation process not only at the initial connection of the communication device 30 but also periodically. The interval at which the environment adaptation adjustment unit 13A performs the periodic environment adaptation process is not limited, but for example, it may be at one-month intervals.

[0104] FIG. 12 is a flowchart showing the process (periodic environment adaptation process) that the environment adaptation adjustment unit 13A periodically performs.

[0105] When starting the periodic environment adaptation process, the environment adaptation adjustment unit 13A first acquires the communication data for the past N days (S601), and further acquires the detection results for the past N days (S602). Here, as the N days, for example, about 30 days may be set.

[0106] Next, the environment adaptation adjustment unit 13A performs a process of determining the presence or absence of an environmental change in the monitored network 40 based on the acquired communication data and detection results (hereinafter referred to as "environmental change determination process") (S603). If it is determined that there has been an environmental change (the environmental change is more than a predetermined amount), the process proceeds to step S604 (described later) (the environment adaptation process), and if it is determined that there has been no environmental change (the environmental change is less than or equal to a predetermined amount), the periodic environmental change determination process ends (ends without performing the environment adaptation process this time).

[0107] When it is determined in the above step S603 that there is an environmental change, the environment adaptation adjustment unit 13A (parameter adjustment unit 131A and overall threshold adjustment unit 132A) executes an environment adaptation process (S604 to S606), and this regular process for this time ends. Note that since the processes in steps S604 to S606 are the same as the above steps S106 to S108, detailed descriptions thereof are omitted.

[0108] Next, the details of the environmental change determination process (the process in step S603 above) performed by the environment adaptation adjustment unit 13A will be described.

[0109] FIG. 13 is a flowchart showing the environmental change determination process performed by the environment adaptation adjustment unit 13A.

[0110] When starting the environmental change determination process, the environment adaptation adjustment unit 13A acquires communication data (communication data held in the communication data storage unit 121) for the most recent first period (for example, a period of the most recent one week), applies a kernel density estimation function to each feature quantity item of the acquired communication data, and estimates the probability density distribution according to the value (S701).

[0111] Next, the environment adaptation adjustment unit 13A acquires communication data (communication data held in the communication data storage unit 121) for the most recent second period (a period including a period more past than the first period; for example, a period of the most recent 30 days) for each feature quantity item, applies a kernel density estimation function to each feature quantity item of the acquired communication data, and estimates the probability density distribution according to the value (S702).

[0112] Next, for each item of feature quantity, the environment adaptation adjustment unit 13A compares the probability density distribution in the first period with the probability density distribution in the second period (S704). If there are a predetermined number or more (for example, when it is 1 or more) of feature quantity items with a similarity below a predetermined value, it is determined that there has been an environmental change (S705), and the process ends. If the number of items with a similarity below the predetermined value is less than the predetermined number (for example, when it is 0), it is determined that there has been no environmental change (S706), and the process ends. At this time, the specific processing method for comparing (calculating the similarity) the probability density distributions of the two types is not limited. For example, the mean squared error or the mean absolute error may be used.

[0113] (B-3) Effects of the Second Embodiment According to the second embodiment, in addition to the effects of the first embodiment, the following effects can be achieved.

[0114] In the monitoring device 10A of the second embodiment, the trend of communication data in the monitored network 40 is periodically determined, and when the trend of the communication data changes, parameters and thresholds can be automatically updated to adapt to the environment.

[0115] (C) Other Embodiments The present invention is not limited to the above-described embodiments, and modified embodiments as exemplified below can also be cited.

[0116] (C-1) In each of the above-described embodiments, an example in which the detection engine unit 11, the temporary storage unit 12, and the environment adaptation adjustment units 13 and 13A are arranged in the same device has been shown, but they may be distributed and arranged in a plurality of devices (computers (for example, servers or terminals)).

[0117] (C-2) In each of the above-described embodiments, the environment adaptation adjustment unit 13 performs parameter adjustment processing and overall threshold adjustment processing during environment adaptation processing, but only one of them may be performed.

Explanation of Reference Numerals

[0118] 10…Monitoring device, 10A…Monitoring device, 11…Detection engine unit, 12…Temporary storage unit, 13…Environment adaptation adjustment unit, 13A…Environment adaptation adjustment unit, 20…Network switch, 21…Interface, 30…Communication device, 40…Monitored network, 111…Communication data acquisition unit, 112…Individual threshold calculation unit, 113…Abnormality detection unit, 121…Communication data storage unit, 122…Parameter storage unit, 123…Threshold storage unit, 124…Detection result storage unit, 131…Parameter adjustment unit, 131A…Parameter adjustment unit, 132…Overall threshold adjustment unit, 132A…Overall threshold adjustment unit, 1231…Individual threshold storage unit, 1232…Overall threshold storage unit, 1311…Parameter table, 1312…Combination table, 1440…Combination number

Claims

1. An abnormality detection means that performs a detection process of analyzing communication data generated on a network to detect an abnormality in the network and outputs a detection result; A threshold holding means that holds a threshold used in the detection process; A parameter holding means that holds one or more parameters used when obtaining a part or all of the thresholds; Calculation means for calculating, based on the communication data and / or the detection result, a part or all of the thresholds held by the threshold holding means and / or a part or all of the parameters held by the parameter holding means; A monitoring device characterized by comprising the above.

2. The monitoring device according to claim 1, wherein the threshold holding means includes an individual threshold set individually for each communication device to be the target of the detection process and an overall threshold common to all communication devices to be the target of the detection process.

3. The calculation means: When calculating for the individual threshold, uses the parameter held by the parameter holding means and the communication data within a predetermined period; When calculating for the overall threshold, uses the communication data within a predetermined period. The monitoring device according to claim 2, characterized by the above.

4. The monitoring device according to claim 3, wherein the calculation means calculates the parameter using the communication data within a predetermined period and sets it in the parameter holding means.

5. The monitoring device according to claim 4, wherein the calculation means performs a parameter adjustment process of newly calculating the parameter and setting it in the parameter holding means, and / or an overall threshold adjustment process of newly calculating the overall threshold and setting it in the threshold holding means after a predetermined period from when the monitoring device is connected to the network.

6. The monitoring device according to claim 5, wherein the calculation means performs an environmental change determination process of determining the presence or absence of an environmental change on the network based on the communication data at regular intervals, and performs the parameter adjustment process and / or the overall threshold adjustment process when it is determined that there is an environmental change as a result of the environmental change determination process.

7. The monitoring device according to claim 6, wherein the calculation means performs the environmental change determination process by comparing the communication data for a most recent first period with the communication data for a second period including a period past the first period.

8. A computer is caused to function as an anomaly detection means that analyzes communication data generated on a network, performs detection processing for detecting anomalies in the network, and outputs a detection result; a threshold holding means that holds thresholds used in the detection processing; a parameter holding means that holds one or more parameters used when obtaining part or all of the thresholds; and a calculation means that calculates based on the communication data and / or the detection result for part or all of the thresholds held by the threshold holding means and / or part or all of the parameters held by the parameter holding means A monitoring program characterized by the above.

9. In a monitoring method performed by a monitoring device, the monitoring device includes an anomaly detection means, a threshold holding means, a parameter holding means, and a calculation means, the anomaly detection means analyzes communication data generated on a network, performs detection processing for detecting anomalies in the network, and outputs a detection result, the threshold holding means holds thresholds used in the detection processing, the parameter holding means holds one or more parameters used when obtaining part or all of the thresholds, and the calculation means calculates based on the communication data and / or the detection result for part or all of the thresholds held by the threshold holding means and / or part or all of the parameters held by the parameter holding means A monitoring method characterized by the above.

Images