Monitoring device, monitoring program, and monitoring method

Abstract

To efficiently perform detection even when there is attack communication having long intervals between accesses on a monitored network.SOLUTION: The present invention relates to a monitoring device for monitoring a network. The monitoring device of the present invention has anomalous communication detection means including a plurality of detection processing units that perform detection processing to detect network anomalies by analyzing traffic data for each flow generated on the network. A first detection processing unit analyzes the traffic data, counts the number of destination elements for each address of flows included in the traffic data, and when the number of destination elements is equal to or greater than a predetermined threshold, determines that a transition condition to transition to processing by another detection processing unit has been met, and starts processing by the other detection processing unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a monitoring device, a monitoring program, and a monitoring method, and can be applied to, for example, a system that analyzes network traffic data to detect abnormalities on a network. [Background technology]

[0002] Conventionally, there exist monitoring devices that collect and analyze packet data flowing through a network for the purpose of monitoring security on the network. An example of a conventional monitoring device is a system disclosed in Patent Document 1.

[0003] The system described in Patent Document 1 collects network traffic data flowing from the Internet, detects anomalous communications, including slow scan attack communications that scan terminals within the network at low speeds over long periods of time, and supports the function of calculating the maliciousness of the communications. The maliciousness of communications is a parameter that indicates the degree of security threat or risk, and can be calculated, for example, from host access from the access source, port access, access time interval, and access policy violations. The system described in Patent Document 1 evaluates communications with long access intervals, such as slow scan attack communications, as being highly malicious and detects them as anomalous communications. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-175714 Summary of the Invention [Problem to be solved by the invention]

[0005] Here, the problems with the system described in Patent Document 1 will be described.

[0006] First, the system described in Patent Document 1 has a problem in that it cannot detect anomalous communications, including slow scan attack communications, unless the threshold value for a series of access time intervals is appropriately set.

[0007] FIG. 9 is an explanatory diagram showing the problem in the conventional technology (the system described in Patent Document 1).

[0008] FIG. 9 shows the timing of access (packet detection) occurrence when slow scan attack communication occurs. In FIG. 9, the horizontal axis represents elapsed time, and downward arrows indicate the timing of access (packet) occurrence. In the slow scan attack communication shown in FIG. 9, a series of accesses (a state in which multiple accesses occur consecutively at short time intervals; a state in which multiple accesses occur in a burst) occurs at time intervals of T [seconds]. In FIG. 9, the interval between accesses in a series of accesses is set to t [seconds]. In the system described in Patent Document 1, a threshold th for the time interval between accesses is used to determine whether to continue detecting a series of accesses. In other words, in the system described in Patent Document 1, if a series of accesses does not occur for a period of time equal to or greater than the threshold th for a certain flow (i.e., if T>th), control is performed to stop monitoring the flow.

[0009] From the above, in the system described in Patent Document 1, if the threshold value for the series of access times th is set too small, the detection device may mistakenly recognize that communication has ended even if the slow scan attack communication is continuing, and if the threshold value th is too large, there is a possibility that detection of the slow scan attack communication will be delayed.

[0010] Furthermore, the system described in Patent Document 1 has a problem in that detection of slow scan attack communications is delayed when communications are performed continuously. Specifically, in the system described in Patent Document 1, when the access time interval t between packets is short and communications are performed continuously, the system cannot analyze the communications until the time interval T of a series of accesses passes the threshold th for the series of access time intervals, which may result in a delay in detection of slow scan attack communications.

[0011] In view of the above problems, there is a need for a monitoring device, a monitoring program, and a monitoring method that can efficiently detect attack communications even when there are long intervals between accesses on a monitored network. [Means for solving the problem]

[0012] The monitoring device of the first invention has an abnormal communication detection means having a plurality of detection processing units that perform detection processing to analyze traffic data for each flow generated on a network and detect abnormalities in the network, and the first detection processing unit analyzes the traffic data, counts the number of destination elements for each address of the flow included in the traffic data, and when the number of destination elements becomes equal to or greater than a predetermined threshold, determines that the transition condition for transitioning to processing of another detection processing unit has been met, and starts processing of the other detection processing unit.

[0013] The second monitoring program of the present invention causes a computer to function as an abnormal communication detection means having a plurality of detection processing units that perform detection processing to analyze traffic data for each flow generated on a network and detect abnormalities in the network, and is characterized in that a first detection processing unit analyzes the traffic data, tallies the number of destination elements for each address of the flow contained in the traffic data, and when the number of destination elements becomes equal to or greater than a predetermined threshold, determines that a transition condition for transitioning to processing by another detection processing unit has been met, and starts processing by the other detection processing unit.

[0014] The third aspect of the present invention is a monitoring method performed by a monitoring device, wherein the monitoring device comprises an anomalous communication detection means, and the anomalous communication detection means comprises a plurality of detection processing units that perform detection processing to analyze traffic data for each flow generated on a network and detect abnormalities in the network, and a first detection processing unit analyzes the traffic data, tallies the number of destination elements for each address of the flow included in the traffic data, and when the number of destination elements becomes equal to or greater than a predetermined threshold, determines that a transition condition for transitioning to processing by another detection processing unit has been met, and starts processing by the other detection processing unit. [Effects of the Invention]

[0015] According to the present invention, it is possible to provide a monitoring device, a monitoring program, and a monitoring method that can efficiently detect attack communications even when there are long intervals between accesses on a network to be monitored. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 2 is a diagram showing the connection relationships of devices related to the first and second embodiments and the functional configuration of a monitoring device according to this embodiment. [Figure 2] FIG. 2 is an explanatory diagram showing an example of the configuration of traffic data according to the first embodiment; [Figure 3] FIG. 2 is an explanatory diagram showing an example of the configuration of shaped traffic data according to the first embodiment; [Figure 4] FIG. 2 is an explanatory diagram showing an example of the configuration of detection data (detection results) according to the first embodiment. [Figure 5] 5 is a flowchart showing the operation of an anomalous communication detection processing unit according to the first embodiment. [Figure 6] 4 is a flowchart showing the operation of a first detection process (first detection logic) according to the first embodiment. [Figure 7] 10 is a flowchart showing the operation of an anomalous communication detection processing unit according to the second embodiment. [Figure 8]10A and 10B are diagrams illustrating a specific example of a detection result integration process executed by an anomalous communication detection unit according to the second embodiment. [Figure 9] FIG. 1 is an explanatory diagram showing a problem in the prior art. DETAILED DESCRIPTION OF THE INVENTION

[0017] (A) First embodiment A first embodiment of a monitoring device, a monitoring program, and a monitoring method according to the present invention will be described below in detail with reference to the drawings.

[0018] (A-1) Configuration of the First Embodiment Fig. 1 is a diagram showing the connection relationships of devices related to the first embodiment and the functional configuration of a monitoring device 10 according to this embodiment. Note that in Fig. 1, the reference numerals in parentheses are used only in the second embodiment, which will be described later.

[0019] In this embodiment, the monitoring device 10 will be described as a device that monitors (analyzes) communications in a monitored network 40 (a network to be analyzed). Communication devices 30 (30-1, 30-2, ...) to be monitored are connected to the monitored network 40. Note that the number of communication devices 30 to be monitored is not limited. The communication devices 30 may be various communication devices such as servers, clients, network devices, etc.

[0020] In this embodiment, the monitored network 40 is operated under a policy that, in principle, it is a closed network (a network not connected to an external network such as the Internet). However, a user of the communication device 30 may violate the policy by connecting to the Internet using a mobile terminal (e.g., a smartphone, a mobile router, etc.) not shown, or by connecting a portable data recording medium (e.g., a portable memory such as a USB memory) not shown to the communication device 30, which could result in malware being installed on the communication device 30. Furthermore, a communication device 30 not managed by the system administrator may be connected to the monitored network 40. Furthermore, a malicious person may become a user of the communication device 30. In other words, the monitored network 40 is operated under the management of a system administrator under a policy of a closed network in principle, but a source of an attack may emerge within the communication device 30 during operation. The security policy for the monitored network 40 is not limited to the above example, and various policies can be applied.

[0021] In the monitored network 40, a network switch 20 is disposed at a location (a location in the network connection configuration) where traffic from each communication device 30 and the like is concentrated. The monitoring device 10 uses this network switch 20 as an observation point on the monitored network 40 (in this embodiment, the interface 21 of the network switch 20) and analyzes communications (traffic) transmitted and received (relayed) by the network switch 20 (interface 21) based on features. Here, a collection of features of packet sequences transmitted and received (relayed) by the network switch 20 (interface 21) (a collection of features for each communication device 30) is referred to as "traffic data." Here, the packet sequence data itself is supplied from the network switch 20 having the observation point to the monitoring device 10 (for example, by a port mirroring function, etc.), and the packet sequence data is converted into traffic data by the monitoring device 10. However, the monitoring device 10 may be configured to acquire the traffic data itself from an external source (for example, an external network probe or the network switch 20 itself).

[0022] In this embodiment, the interface 21 of the network switch 20 is used as an observation point (monitoring point) for collecting traffic data, but the location and number of observation points are not limited.

[0023] Next, the internal configuration of the monitoring device 10 will be described with reference to FIG.

[0024] The monitoring device 10 includes a preprocessing unit 110, an anomalous communication detection processing unit 120, and an anomalous communication detection result processing unit .

[0025] The preprocessing unit 110 acquires network traffic data from the network switch 20, formats the acquired network traffic data, and saves the data.

[0026] The anomalous communication detection processing unit 120 performs processing to detect anomalous communication such as a slow scan attack from the stored network traffic data (hereinafter referred to as "anomaly detection processing").

[0027] The anomalous communication detection result processing unit 130 outputs the result of the anomaly detection processing performed by the anomalous communication detection processing unit 120. The means by which the anomalous communication detection result processing unit 130 outputs the result of the anomaly detection processing is not limited, and various output means can be applied. For example, the anomalous communication detection result processing unit 130 may output the result of the anomaly detection processing from a display device such as a display, or may send the data of the result of the anomaly detection processing in a predetermined message format to a predetermined destination (for example, sent to a terminal used by a system administrator), or may send it via email or various message services (for example, sent to an ID used by a system administrator).

[0028] Next, the internal configuration of the preprocessing unit 110 will be described.

[0029] The preprocessing unit 110 includes a traffic data acquisition unit 111 , a traffic data shaping unit 112 , and a shaped traffic data holding unit 113 .

[0030] The traffic data acquisition unit 111 has the function of acquiring traffic data obtained from the network switch 20. The traffic data acquisition unit 111 supplies the acquired traffic data to the traffic data shaping unit 112. Here, the traffic data acquired by the traffic data acquisition unit 111 will be described as being in the format shown in FIG.

[0031] FIG. 2 is an explanatory diagram showing an example of the configuration of traffic data.

[0032] In Figure 2, one line shows the traffic data for one flow. The traffic data shown in Figure 2 includes identification information for identifying the flow (source IP address, destination IP address, source port number, destination port number, and communication protocol), communication volume (unit: kbytes), flow start time (timestamp of when the flow occurred), and other information. Note that the format of the traffic data shown in Figure 2 is an example, and the combination and number of items to be set are not limited.

[0033] The traffic data shaping unit 112 performs a process (hereinafter simply referred to as "shaping process") to shape data (shape the supplied traffic data) necessary for processing by the anomalous communication detection processing unit 120. Because the traffic data before shaping may contain data or missing values ​​that are unnecessary for processing by the anomalous communication detection processing unit 120, these are removed by the traffic data shaping process. Note that if the traffic data acquired by the traffic data acquisition unit 111 is already in a format that can be used by the anomalous communication detection processing unit 120, no shaping process is particularly necessary (in other words, the traffic data shaping unit 112 may be omitted). The traffic data shaping unit 112 supplies the shaped traffic data to the saved traffic data acquisition unit 121 for storage. Hereinafter, the traffic data shaped by the traffic data shaping unit 112 will be referred to as "shaped traffic data."

[0034] FIG. 3 is a diagram showing an example of the configuration of shaped traffic data.

[0035] In Figure 3, one line shows the shaped traffic data for one flow. The shaped traffic data shown in Figure 3 consists only of identification information for identifying the flow (source IP address, destination IP address, source port number, destination port number, and communication protocol), communication volume (unit: kbytes), and flow start time (timestamp of when the flow occurred). Note that the format of the shaped traffic data shown in Figure 3 is just an example, and the combination and number of items to be set are not limited.

[0036] The shaped traffic data storage unit 113 has a function of storing the shaped traffic data. The shaped traffic data storage unit 113 supplies the stored shaped traffic data to the anomalous communication detection processing unit 120.

[0037] Next, the internal configuration of the anomalous communication detection processing unit 120 will be described.

[0038] The anomalous communication detection processing unit 120 performs processing (anomaly detection processing) to detect anomalous communication such as scan attack communication using the shaped traffic data supplied from the preprocessing unit 110. The anomalous communication detection processing unit 120 periodically collects the shaped traffic data and performs anomaly detection processing. The anomalous communication detection processing unit 120 has an anomalous communication detection unit 122, a temporary data holding unit 123, a detected data deletion unit 124, and an anomalous communication detection result processing unit 130.

[0039] The stored traffic data acquisition unit 121 performs processing to acquire the shaped traffic data stored in the shaped traffic data holding unit 113 of the preprocessing unit 110. The shaped traffic data acquired by the stored traffic data acquisition unit 121 is supplied to the anomalous communication detection unit 122.

[0040] The anomalous communication detection unit 122 performs a process (anomaly detection process) of analyzing and detecting anomalous communication using the shaped traffic data supplied from the saved traffic data acquisition unit 121. The anomalous communication detection unit 122 performs the anomaly detection process from various perspectives. Hereinafter, the perspectives of anomaly detection are also referred to as "detection logics." The anomalous communication detection unit 122 performs detection processes based on N (N is an integer of 2 or more) detection logics. That is, the anomalous communication detection unit 122 performs detection processes based on a first detection logic, a second detection logic, ..., an Nth detection logic. Hereinafter, the detection process based on the "ith detection logic" (i is an integer from 1 to N) will be referred to as the "ith detection process." For example, the detection process based on the first detection logic will be referred to as the first detection process. In this specification, the elements (e.g., programs, etc.) that execute each detection process (detection logic) in the anomalous communication detection unit 122 will also be referred to as the "detection processing unit."

[0041] The anomalous communication detection unit 122 performs a process (hereinafter referred to as a "destination address count process") to count the number of destination IP addresses (the number of destination IP addresses in the set of flows originating from the target source address; hereinafter referred to as the "destination address count process") for each source address of a flow included in the shaped traffic data to be processed (hereinafter referred to as a "target source address"), and performs a process to detect the presence or absence of attack communication such as a host scan (i.e., the presence or absence of an anomaly) based on the result of comparing the number of destination addresses with a threshold value (hereinafter referred to as "TH1") for each target source address. In other words, the anomalous communication detection unit 122 also performs a detection process based on the destination address count process (destination address count). Hereinafter, the detection logic including the destination address count process (destination address count) will be referred to as the "first detection logic." The threshold value TH1 may be a fixed value or a dynamic value. Furthermore, the threshold value TH1 may be a different value for each target source address (each communication device 30).

[0042] Here, a detailed example of the destination address counting process will be described. Here, the target source address to be counted is assumed to be address A1. In this case, the anomalous communication detection unit 122 assumes that there are five communication flows in the shaped traffic data with the source address A1. In this case, it is assumed that the destination address of the first flow is address A2, the destination address of the second flow is address A3, the destination address of the third flow is address A4, the destination address of the fourth flow is address A2, and the destination address of the fifth flow is address A3. In this case, when the target source address is address A1, there are three destination addresses, A2, A3, and A4, so the number of destination addresses is 3. The anomalous communication detection unit 122 may perform the above process for each target source address and detect an abnormality when there is a target source address whose number of destination addresses exceeds the threshold TH1.

[0043] For example, if a communication device 30 (a source address of interest) with a large number of destination addresses exists, there is a possibility that the communication device 30 is infected with malware that is attempting to connect (attack communication) to a surrounding communication device 30 (for example, another communication device 30 connected on the same sub-network). In other words, the presence of a communication device 30 (a source address of interest) with a large number of destination addresses suggests the possibility that attack communication, including slow scan attack communication (host scan attack), is occurring. Therefore, the anomalous communication detection unit 122 can perform anomaly detection (detection processing based on the first detection logic) based on the destination address count processing (number of destination addresses) as described above.

[0044] As described above, the anomalous communication detection unit 122 performs the first to Nth detection processes in the anomaly detection process, but the order in which they are performed is not limited. Furthermore, the anomalous communication detection unit 122 may simultaneously perform multiple detection processes in parallel.

[0045] The output format of the detection results of each detection logic (each detection process) is not limited, but for example, a value indicating the degree of malignancy (degree of security threat) (hereinafter referred to as "malignancy level") may be added to the shaped traffic data and output. In this embodiment, the anomalous communication detection unit 122 combines the detection results of each detection logic (each detection process) and outputs at least a numerical value of malignancy level. The higher the numerical value, the higher the malignancy level.

[0046] In this embodiment, the anomalous communication detection unit 122 outputs data (hereinafter referred to as "detection data") in which the detection result is added to the shaped traffic data. The anomalous communication detection unit 122 supplies the detection data to the anomalous communication detection result processing unit 130, the temporary data holding unit 123, and the detection data deletion unit 124.

[0047] FIG. 4 is a diagram showing an example of the configuration of the detection data output by the anomalous communication detection unit 122. As shown in FIG.

[0048] In Figure 4, one line shows the detection data for one flow. In the detection data shown in Figure 4, a "malignancy" item has been added as a detection result to the shaped traffic data items. Note that the format of the detection data shown in Figure 4 is just an example, and the combination and number of items that can be set are not limited.

[0049] The temporary data storage unit 123 stores the detection data supplied from the anomalous communication detection unit 122 .

[0050] The sensing data deletion unit 124 performs processing to delete a portion of the sensing data stored in the temporary data storage unit 123. Details of the processing performed by the sensing data deletion unit 124 will be described later.

[0051] (A-2) Operation of the First Embodiment Next, the operation of the monitoring device 10 (the monitoring method according to the embodiment) will be described.

[0052] FIG. 5 is a flowchart showing the overall operation of the abnormal communication detection process by the abnormal communication detection unit 122 (the abnormal communication detection processing unit 120).

[0053] The flowchart in FIG. 5 shows the processing that is executed when the anomalous communication detection unit 122 receives shaped traffic data.

[0054] 5, the anomaly detection process by the anomalous communication detection unit 122 executes each detection process in the order of step S1-1 of the first detection process (first detection logic), step S1-2 of the second detection process (second detection logic), ..., step S1-N-1 of the (N-1)th detection process (N-1)th detection logic, and step S1-N of the Nth detection process (Nth detection logic). That is, the anomalous communication detection unit 122 executes steps S1-1 to S1-N sequentially.

[0055] When the shaped traffic data is supplied, the first detection logic executes a destination address number counting process, and when there is a source IP address (target source address) whose number of destination addresses exceeds the threshold TH1, it supplies the detection data (detection data stored in the temporary data storage unit 123) to the second detection process (step S1-2) to be executed. In other words, when a source IP address whose number of destination addresses exceeds the threshold TH1 occurs, the first detection logic operates to supply the detection data (shaped traffic data) accumulated in the temporary data storage unit 123 to the second and subsequent detection logics for analysis.

[0056] The second detection process to the N-1th detection process (steps S1-2 to S1-N-1) execute detection processes using a predetermined detection logic on the detection data supplied from the previous stage, reflect the detection results in the detection data (for example, update the malignancy value), and output the results to the subsequent stage. Finally, the Nth detection process (step S1-N) executes detection processes using a predetermined detection logic on the detection data supplied from the previous stage, reflects the detection results in the detection data, and outputs the results as the final detection result of the anomalous communication detection unit 122.

[0057] The operation of the detection logic (detection process) of the second to Nth detection logics (second to Nth detection processes) is not limited, and for example, a detection process that focuses on the destination port number, a detection process that focuses on the regularity of changes in the destination address and destination port number, a detection process that focuses on access to destination port numbers that are likely to be targets of attacks (e.g., 22 for SSH, 23 for TELNET, 445 for SMB, 3389 for RDP, etc.), a detection process that focuses on communication destinations where the destination address is rare for the source address across the entire monitored network, and a detection process that focuses on the communication data size for each communication flow can be applied.

[0058] Furthermore, the detection logic (detection process) of the first to Nth detection logics (first to Nth detection processes) may include a process of calculating a degree of malignancy according to the number of destination addresses. For example, in the detection process (detection logic) that calculates a degree of malignancy according to the number of destination addresses, a degree of malignancy proportional to the number of destination addresses for the source IP address may be calculated for each piece of detection data, or a degree of malignancy equal to or greater than a predetermined value (for example, a value of about 1 may be set) may be set for detection data relating to an address with an excess number of destination addresses (an address whose number of destination addresses exceeds a threshold TH1).

[0059] Next, a specific example of the first detection process (step S1-1) performed by the anomalous communication detection processing unit 120 (mainly the anomalous communication detection unit 122) will be described.

[0060] FIG. 6 is a flowchart showing the first detection process (step S1-1) performed by the anomalous communication detection processing unit 120 (the anomalous communication detection unit 122 and the detected data deletion unit 124).

[0061] First, it is assumed that the anomalous communication detection unit 122 acquires the shaped traffic data from the saved traffic data acquisition unit 121 (S201).

[0062] Next, the anomalous communication detection unit 122 divides (classifies) the acquired shaped traffic data by destination IP address (S202).

[0063] Next, the anomalous communication detection unit 122 adds a malignancy item to each of the acquired shaped traffic data as a detection result and acquires the data in the form of detected data (S203). At this time, the anomalous communication detection unit 122 may set a predetermined initial value (e.g., 0) for the malignancy value to each detected data, or may set the malignancy value based on a predetermined detection logic. Specifically, for example, the anomalous communication detection unit 122 may calculate and set the malignancy according to the number of destination addresses.

[0064] Next, the anomalous communication detection unit 122 counts the number of destination addresses for each source IP address (target source address) based on the newly acquired detection data and the detection data stored in the temporary data storage unit 123 (S204).

[0065] Next, the abnormal communication detection unit 122 supplies the data to the temporary data storage unit 123 to store it (S205).

[0066] Next, the anomalous communication detection unit 122 checks whether there is a source IP address whose number of destination addresses exceeds the threshold value TH1 (hereinafter referred to as an "excess destination address address") (S206), and if there is an excess destination address address, it proceeds to step S207 described below, otherwise it terminates the processing (it does not start the second detection processing at the subsequent stage and waits until the next shaped traffic is input).

[0067] In this case, the anomalous communication detection unit 122 may set the threshold value TH1 to each source IP address (target source address) in any manner. The threshold value TH1 may be a fixed value, or may be a different value for each source IP address (communication device 30). Furthermore, even for the same source IP address (communication device 30), different values ​​may be applied at different processing times. For example, the anomalous communication detection unit 122 may set a value equivalent to 30% of the number of communication devices 30 (hereinafter referred to as the "total number of communication devices") located in the monitored network 40. For example, if the total number of communication devices is 100, the threshold value TH1 may be set to 30, which is 30% of that number. The anomalous communication detection unit 122 may acquire, for example, a value set in advance by a system administrator as the total number of communication devices, or may use the number of source IP addresses determined for network monitoring purposes (for example, network configuration information such as an ARP table or MIB information stored in the network switch 20) as the total number of communication devices. Furthermore, for example, the abnormal communication detection unit 122 may be configured to grasp the average number of connected communication devices 30 or the maximum number as the total number of communication devices while the number of connected communication devices 30 fluctuates over a predetermined period (for example, a period of about one month).

[0068] If there is an excess destination address, the detected data deletion unit 124 deletes data relating to the excess destination address from the detected data stored in the temporary data storage unit 123 (S207).

[0069] Furthermore, if there is an address with the excess destination address count, the anomalous communication detection unit 122 supplies the detection data of the flow related to the excess destination address count address to the second detection processing unit at the subsequent stage (S208), and proceeds to the processing from step S1-2 onwards (terminating the processing of step S1-1). Here, the detection data of the flow related to the excess destination address count address may be all the detection data of the flow that has the excess destination address count address as the source IP address or destination IP address.

[0070] The second to N-th detection processes (second to N-th detection logics) may each perform detection processing on the supplied detection data (the shaped traffic data portion) according to a predetermined logic, calculate a malignancy level, and reflect the calculation result in the detection result item (i.e., the malignancy item) of the detection data. For example, the second to N-th detection processes (second to N-th detection logics) may calculate a malignancy level for each flow and add the calculated malignancy level to the malignancy level of the retained detection data. For example, assume that the malignancy level set in the detection data of a certain flow (hereinafter referred to as the "flow of interest") supplied from the (i-1)th detection process in the i-th detection process is 1. In this case, if the malignancy level calculated for the flow of interest in the i-th detection process is 2, the i-th detection process may set the malignancy level of the flow of interest to 1 + 3 = 3 and supply it to the (i+1)th detection process. The final Nth detection process (Nth logic) may output all detection data, or may extract and output only detection data related to abnormality detection (for example, detection data with a malignancy level equal to or greater than a predetermined value).

[0071] (A-3) Effects of the First Embodiment According to the first embodiment, the following effects can be achieved.

[0072] In the monitoring device 10 (anomalous communication detection processing unit 120), when an address exceeding the number of destination addresses is detected in the first detection processing (first detection logic), the monitoring device 10 (anomalous communication detection processing unit 120) executes the second detection processing (Nth detection processing) and subsequent processing. This enables the monitoring device 10 (anomalous communication detection processing unit 120) to detect slow scan attack communications that continue for a long period of time without setting a threshold for the access interval time during monitoring.

[0073] Furthermore, the monitoring device 10 (abnormal communication detection processing unit 120) sequentially analyzes traffic data (reformed traffic data) to monitor whether or not there are any addresses that exceed the number of destination addresses, thereby enabling real-time detection of communication attacks.

[0074] (B) Second embodiment A second embodiment of a monitoring device, a monitoring program, and a monitoring method according to the present invention will be described below in detail with reference to the drawings.

[0075] (B-1) Configuration and operation of the second embodiment The connection relationships of the devices related to the second embodiment and the functional configuration of the monitoring device 10A according to the second embodiment can also be shown using Figure 1. Note that in Figure 1, the reference numerals in parentheses are used only in the second embodiment.

[0076] The monitoring device 10A of the second embodiment differs from the first embodiment in that the anomalous communication detection processing unit 120 is replaced with an anomalous communication detection processing unit 120A. Also, the anomalous communication detection unit 122A of the second embodiment differs from the first embodiment in that the anomalous communication detection unit 122 is replaced with an anomalous communication detection unit 122A.

[0077] In the anomalous communication detection unit 122 of the first embodiment, the second to Nth detection processes (second to Nth detection logics) were processed sequentially one by one, but the anomalous communication detection unit 122A of the second embodiment differs from the first embodiment in that the second to Nth detection processes (second to Nth detection logics) are processed in parallel.

[0078] FIG. 7 is a flowchart showing the overall operation of the abnormal communication detection process by the abnormal communication detection unit 122A (abnormal communication detection processing unit 120A).

[0079] 7, in the anomaly detection process by the anomalous communication detection unit 122A, second to Nth detection processes (steps S1-2 to S1-N) are arranged in parallel after step S1-1 of the first detection process (first detection logic). In the anomaly detection process by the anomalous communication detection unit 122A, all of the detection process results from the second to Nth detection processes (steps S1-2 to S1-N) are supplied to step S3, which executes a process of integrating the results of the detection processes (hereinafter referred to as a "detection result integration process"). The detection result integrated in step S3 is output in step S4 (supplied to the anomalous communication detection result processing unit 130). In the second embodiment, the process itself of processing data supplied from the previous stage in each detection logic and outputting it to the subsequent stage is the same as in the first embodiment, and therefore will not be described in detail.

[0080] Next, the detection result integration process in step S3 will be described.

[0081] In step S3 (detection result integration process), a malignancy value is calculated for each piece of detected data (each flow) calculated in the second to Nth detection processes (steps S1-2 to S1-N). The anomalous communication detection processing unit 120 then aggregates these values ​​for each piece of detected data (each flow) to calculate an integrated malignancy value for each piece of detected data (each flow) (hereinafter, this integrated malignancy will be referred to as the "integrated malignancy"), sets the integrated malignancy in the malignancy field for each piece of detected data, and supplies the integrated malignancy to step S4. In the detection result integration process, the anomalous communication detection unit 122A may calculate the integrated malignancy in any manner. For example, the anomalous communication detection unit 122A may calculate the total value of the malignancies calculated in each detection process for each flow (detection data) as the integrated malignancy. Furthermore, for example, the anomalous communication detection unit 122A may perform detection result integration processing (processing for calculating the integrated malignancy level) using various methods such as statistical processing of averages and variance values ​​for each source address, machine learning, deep learning models, etc.

[0082] FIG. 8 is a diagram showing a specific example of the detection result integration process executed by the anomalous communication detection unit 122A in step S3.

[0083] Fig. 8(a) shows the detection results (detection data) in the second detection process, Fig. 8(b) shows the detection results (detection data) in the third detection process, Fig. 8(c) shows the detection results (detection data) in the Nth detection process, and Fig. 8(d) shows the result of integrating the detection results (detection data) in Fig. 8(a) to Fig. 8(c). Note that in the example of Fig. 8, the malignancy levels calculated for all flows (detection data) other than the second, third, and Nth detection processes are assumed to be 0. 8, focusing on a flow whose source IP address is 192.168.11.98 (hereinafter, this flow will be referred to as the "flow of interest"), the malignancy level of the result of the second detection process is 0.92, the malignancy level of the result of the third detection process is 0.69, and the malignancy level of the result of the Nth detection process is 0.98, so the integrated malignancy level is 0.92 + 0.69 + 0.98 = 2.59. The anomalous communication detection unit 122A may, for example, extract detection data whose integrated malignancy level is higher than a predetermined level or detection data whose malignancy level falls within a predetermined percentage from the top (for example, approximately the top 10%), and output only the extracted detection data as detection data in which an anomaly has been detected.

[0084] (B-2) Effects of the Second Embodiment According to the second embodiment, in addition to the effects of the first embodiment, the following effects can be achieved.

[0085] In the monitoring device 10A (anomalous communication detection processing unit 120A) of the second embodiment, the second to Nth detection processes (second to Nth detection logics) are processed in parallel, thereby reducing the time required to detect anomalous communication, including slow scan attack communication, and improving detection accuracy.

[0086] (C) Other embodiments The present invention is not limited to the above-described embodiments, and may include modified embodiments such as those exemplified below.

[0087] (C-1) In each of the above embodiments, there are no limitations on the specific configurations of the shaped traffic data storage unit 113 and the temporary data storage unit 123. For example, the shaped traffic data storage unit 113 and the temporary data storage unit 123 are not limited to a database configuration (a configuration in which each data is managed in a single database), and may be a file format configuration (for example, a format in which each data is configured as a separate file (e.g., text data)).

[0088] (C-2) In each of the above embodiments, the specific content of each detection process (detection logic) executed by the anomalous communication detection units 122 and 122A is not limited, and may be, for example, a method of detecting anomalous communication using statistics, machine learning, or a deep learning model (deep learning).

[0089] (C-3) In the second embodiment, an example was described in which the detection result integration process performed by the anomalous communication detection unit 122A detects attack communications based on the malignancy obtained from the detection process, but information other than the malignancy may also be used in the detection result integration process. For example, the detection result integration process may detect anomalous communications using the destination address, port number, communication protocol, communication data size, flow start time, etc.

[0090] (C-4) In each of the above embodiments, the monitoring devices 10 and 10A detect the number of destination addresses for each source IP address and detect a host scan communication attack (an attack that searches for attackable hosts (IP addresses)) when the number of destination addresses exceeds a threshold TH1. However, the number of ports used as destination ports for each host (each IP address) (hereinafter referred to as the "destination port number") may be detected, and a port scan against that host may be detected when an address whose destination port number exceeds a predetermined threshold (hereinafter referred to as an "address with an excess destination port number") is found. That is, in each of the above embodiments, the "number of destination addresses for a specific address (host)" may be replaced with the "number of destination ports for a specific address (host)," and a process for detecting an "address with an excess destination port number" may be performed. Furthermore, in each of the above embodiments, the monitoring devices 10 and 10A may perform a process for detecting both addresses with an excess destination port number and addresses with an excess destination address number. For example, in the above embodiment, the monitoring device 10, 10A may determine that the conditions for transitioning to the second to Nth detection processes (hereinafter also referred to as "transition conditions") are met when an address with excess destination addresses and / or an address with excess destination ports is detected in the first detection process, and may start the second to Nth detection processes. That is, in the above embodiment, the monitoring device 10, 10A may be configured to satisfy the transition conditions and start the second to Nth detection processes when either an address with excess destination addresses or an address with excess destination ports is detected in the first detection process, or to satisfy the transition conditions and start the second to Nth detection processes when both an address with excess destination addresses and an address with excess destination ports are detected.

[0091] In addition, in the above embodiments, the monitoring devices 10 and 10A count IP addresses in the destination address count process, but other address systems, such as MAC (Media Access Control) addresses, may also be used. For example, the monitoring devices 10 and 10A may count the number of destination MAC addresses for each host (each source MAC address) instead of the number of destination IP addresses in the destination address count process. In this case, the traffic data must include information on the source MAC address and destination MAC address items.

[0092] In this specification, destination addresses (including addresses in various systems such as IP addresses and MAC addresses) and destination ports are also collectively referred to as "destination elements." Also, in this specification, the number of destination addresses and the number of destination ports are also collectively referred to as the "number of destination elements." [Explanation of symbols]

[0093] 10, 10A...monitoring device, 20...network switch, 21...interface, 30...communication device, 40...network to be monitored, 110...preprocessing unit, 111...traffic data acquisition unit, 112...traffic data shaping unit, 113...shaped traffic data storage unit, 120, 120A...anomalous communication detection processing unit, 121...saved traffic data acquisition unit, 122, 122A...anomalous communication detection unit, 123...temporary data storage unit, 124...detected data deletion unit, 130...anomalous communication detection result processing unit.

Claims

1. an abnormal communication detection means including a plurality of detection processing units that analyze traffic data for each flow generated on the network and perform a detection process to detect an abnormality in the network; The first detection processing unit analyzes the traffic data, counts the number of destination elements for each address of a flow included in the traffic data, and when the number of destination elements becomes equal to or greater than a predetermined threshold, determines that a transition condition for transitioning to processing by another detection processing unit has been met, and starts processing by the other detection processing unit. A monitoring device characterized by:

2. 2. The monitoring device according to claim 1, wherein the number of destination elements is the number of destination addresses and / or the number of destination ports.

3. 2. The monitoring device according to claim 1, wherein in said anomalous communication detection means, the detection processing units other than said first detection processing unit are executed one by one in sequence.

4. 2. The monitoring device according to claim 1, wherein in the abnormal communication detection means, a plurality of detection processing units other than the first detection processing unit are executed in parallel.

5. the anomalous communication detection means includes a temporary data storage unit that temporarily stores detection data in which items of detection results are added to the traffic data; When a destination element number excess address in which the number of destination elements exceeds the threshold occurs in the detection data stored in the temporary data storage unit, the first detection processing unit supplies the detection data related to the destination element number excess address to a subsequent detection processing unit.

2. The monitoring device according to claim 1.

6. 6. The monitoring device according to claim 5, further comprising a detected data deletion unit that deletes the detected data relating to the destination element number excess address from the temporary data storage unit.

7. Computer, The network analyzes traffic data for each flow generated on the network and performs a detection process to detect an abnormality in the network. The first detection processing unit analyzes the traffic data, counts the number of destination elements for each address of a flow included in the traffic data, and when the number of destination elements becomes equal to or greater than a predetermined threshold, determines that a transition condition for transitioning to processing by another detection processing unit has been met, and starts processing by the other detection processing unit. A monitoring program characterized by:

8. In a monitoring method performed by a monitoring device, the monitoring device comprises an abnormal communication detection means, the anomalous communication detection means comprises a plurality of detection processing units that perform detection processing to analyze traffic data for each flow generated on the network and detect an anomaly in the network; The first detection processing unit analyzes the traffic data, counts the number of destination elements for each address of a flow included in the traffic data, and when the number of destination elements becomes equal to or greater than a predetermined threshold, determines that a transition condition for transitioning to processing by another detection processing unit has been met, and starts processing by the other detection processing unit. A monitoring method comprising:

Images