Attack information analysis apparatus

Abstract

To specify a contamination range and an attack route of an attack even when a monitoring object device has no or insufficient cyberattacks detection function.SOLUTION: An attack information analysis device (100) includes a normal relational data generation unit (150) that generates normal relational data indicating a normal operation of a monitoring target device, and an execution relational data generation unit (120) that generates execution relational data indicating an operation actually executed by the monitoring target device. The normal relational data and the execution relational data are directed graphs composed of nodes representing objects and edges directed from influencing objects to influenced objects. The attack specifying unit (130) compares the execution relational data with the normal relational data, and determines that an attack has been made on the monitoring target device when any of the nodes and edges constituting the execution relational data is not present in the normal relational data.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an attack information analysis device that analyzes information about cyber attacks. [Background technology]

[0002] When a cyberattack occurs, it is necessary to identify the contamination extent that is expected to be affected by the cyberattack and the intrusion route of the cyberattack in order to take countermeasures and prevent recurrence. A known method for identifying the contamination extent and intrusion route of a cyberattack is to analyze logs starting from detection information indicating the detection of a cyberattack. For example, Patent Document 1 proposes a technology that generates relationship data indicating the relationships between objects from the operation data of multiple software programs, and identifies the intrusion route and contamination extent of the cyberattack based on the relationship data and alert data indicating the detection of a cyberattack. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6987332 Summary of the Invention [Problem to be solved by the invention]

[0004] The technology of Patent Document 1 is based on the premise that alert data indicating the detection of a cyber-attack is known. However, with limited resources such as IoT (Internet of Things) devices, the cyber-attack detection function is often insufficient, and in such cases, the technology of Patent Document 1 is difficult to apply.

[0005] The present disclosure has been made to solve the above-mentioned problems, and aims to provide an attack information analysis device that can identify the contamination scope and attack path of a cyber-attack even if the monitored device does not have a cyber-attack detection function or if the monitored device's attack detection function is insufficient. [Means for solving the problem]

[0006] The attack information analysis device according to the present disclosure includes a design data acquisition unit that acquires design data of a monitored device; a normal relationship data generation unit that extracts, from the design data of the monitored device, operation data indicating operations that affect other objects, and generates normal relationship data indicating normal operations of the monitored device, the normal relationship data being a directed graph consisting of nodes representing objects and edges leading from affecting objects to affected objects, based on the operation data extracted from the design data; a log acquisition unit that acquires a log of the monitored device; and a log acquisition unit that extracts the operation data from the log of the monitored device and generates normal relationship data indicating normal operations of the monitored device, the normal relationship data being a directed graph, based on the operation data extracted from the log. and an attack identification unit that compares the execution relationship data with the normal relationship data, and if any of the nodes and edges constituting the execution relationship data does not exist in the normal relationship data, determines that an attack has been made on the monitored device and identifies an intrusion route and a contamination range of the attack. The attack identification unit identifies the nodes that exist in the execution relationship data but do not exist in the normal relationship data and the nodes that are the origins of the edges as abnormal objects, and identifies the intrusion route by tracing the edges in the reverse direction from the abnormal object, and identifies the contamination range by tracing the edges in the forward direction from the abnormal object. [Effects of the Invention]

[0007] According to the attack information analysis device of the present disclosure, it is possible to identify the contamination scope and attack path of a cyber attack even if the monitored device does not have a cyber attack detection function or if the monitored device's attack detection function is insufficient. [Brief explanation of the drawings]

[0008] [Figure 1]1 is a configuration diagram of an attack information analysis device according to a first embodiment. [Figure 2] FIG. 4 is a diagram showing an example of normal relationship data according to the first embodiment. [Figure 3] FIG. 3 is a diagram showing an example of execution relationship data according to the first embodiment. [Figure 4] 10 is a flowchart of an operation performed by the attack information analysis device according to the first embodiment to generate normal relationship data. [Figure 5] 4 is a flowchart of an operation of the attack information analysis device according to the first embodiment to identify a cyber-attack. [Figure 6] FIG. 11 is a diagram showing an example of normal relationship data in the second embodiment. [Figure 7] FIG. 11 is a diagram showing an example of execution relationship data in the second embodiment. [Figure 8] 11 is a flowchart of an operation of the attack information analysis device according to the third embodiment to generate normal relationship data. DETAILED DESCRIPTION OF THE INVENTION

[0009] <First Embodiment> Fig. 1 shows an example of the configuration of an attack information analysis device 100 according to embodiment 1. As shown in Fig. 1, the attack information analysis device 100 is a computer including hardware such as a processor 101, a memory 102, a communication interface 103, and a storage 104. These pieces of hardware are connected to each other via signal lines.

[0010] The processor 101 is an integrated circuit (IC) that performs arithmetic processing and controls other hardware. Specific examples of the processor 101 include a central processing unit (CPU), a digital signal processor (DSP), and a graphic processing unit (GPU).

[0011] The memory 102 is typically a volatile storage device. The memory 102 is also called a primary storage device or a main memory. Specific examples of the memory 102 include a static random access memory (SRAM) and a dynamic random access memory (DRAM).

[0012] The communication interface 103 is an interface that allows the attack information analysis device 100 to communicate with external devices. Specific examples of the communication interface 103 include interfaces such as Ethernet (registered trademark) and USB (Universal Serial Bus).

[0013] The storage 104 is a non-volatile storage device. Specific examples of the storage 104 include a read-only memory (ROM), a hard disk drive (HDD), and a flash memory. Data stored in the storage 104 is loaded into the memory 102 as needed.

[0014] The attack information analysis device 100 includes, as functional components, a log acquisition unit 110, an execution relationship data generation unit 120, an attack identification unit 130, a design data acquisition unit 140, and a normal relationship data generation unit 150. These functional components are realized when a program (for realizing the function of each functional component) stored in the storage 104 is loaded into the memory 102 and executed by the processor 101.

[0015] The design data acquisition unit 140 acquires design data of a device (hereinafter referred to as a "monitored device") that the attack information analysis device 100 monitors for the presence or absence of a cyber-attack. The design data is data that describes the operation of the monitored device. Specific examples of design data include source code, design documents, and simulation results.

[0016] The normal relationship data generation unit 150 extracts operation data indicating, from the design data of the monitored device acquired by the design data acquisition unit 140, operation data indicating an operation of an object that affects other objects. The operation data indicates an operation when an object performs an operation that affects other objects. Specific examples of operations indicated by the operation data include process startup, file execution, file writing, and file reading. An object is an element used when software is executed. Specific examples of objects include processes, files, and data in shared memory.

[0017] Furthermore, the normal relational data generator 150 generates normal relational data, which is relational data indicating normal operation of the monitored device, based on the operation data extracted from the design data. Here, the "relational data" is a directed graph consisting of nodes and edges.

[0018] An example of normal relationship data 200 is shown in FIG. 2. In FIG. 2, nodes are represented by ovals and edges are represented by arrows. A node is an object. An edge is a directed edge in the behavior data that points from an object that performs an action that affects another object to an object that is affected by that action.

[0019] The log acquisition unit 110 acquires logs of the monitored device. The logs are data that indicate the results of software operations of the monitored device. Specific examples of logs include application logs, OS (Operating System) logs, file operation logs, and communication logs.

[0020] The execution relationship data generation unit 120 extracts operation data from the logs of the monitored devices acquired by the log acquisition unit 110, and generates execution relationship data, which is relationship data indicating operations actually performed by the monitored devices, based on the operation data extracted from the logs. If execution relationship data already exists, the execution relationship data generation unit 120 updates the execution relationship data by adding the newly generated relationship data to the existing execution relationship data. Figure 3 shows an example of execution relationship data 300.

[0021] The attack identification unit 130 compares the normal relationship data generated by the normal relationship data generation unit 150 with the execution relationship data generated by the execution relationship data generation unit 120 to determine whether or not a cyber attack (sometimes simply referred to as an "attack") has occurred on the monitored device. Specifically, the attack identification unit 130 determines that an attack has occurred on the monitored device if, as a result of comparing the normal relationship data with the execution relationship data, any of the elements (nodes and edges) that make up the execution relationship data does not exist in the normal relationship data. In other words, when the attack identification unit 130 detects an element that does not exist in the normal relationship data but does exist in the execution relationship data, it determines that an attack has occurred on the monitored device.

[0022] Furthermore, when the attack identification unit 130 determines that an attack has been made on a monitored device, it identifies the intrusion path and contamination range of the attack. Specifically, the attack identification unit 130 identifies nodes that exist in the execution relationship data but do not exist in the normal relationship data and nodes that are the origins of edges as abnormal objects, and identifies the range reached by tracing the edges included in the execution relationship data in the reverse direction from the abnormal object as the intrusion path. Furthermore, the attack identification unit 130 identifies the range reached by tracing the edges included in the execution relationship data in the forward direction from the abnormal object as the contamination range.

[0023] For example, when comparing the normal relationship data 200 in Fig. 2 with the execution relationship data 300 in Fig. 3, the node of process #5, the edge from process #3 to process #5, and the edge from process #5 to file #2 in the execution relationship data 300 are elements that do not exist in the normal relationship data 200. When a node or edge that does not exist in the normal relationship data exists in the execution relationship data in this way, the attack identification unit 130 determines that an attack has been made on the monitored device.

[0024] The attack identification unit 130 also identifies process #3 in the execution relationship data 300, which is the starting point of a node or edge that does not exist in the normal relationship data 200, as an abnormal object.The attack identification unit 130 then identifies process #2, file #1, and process #1, which are reached by tracing the edges in the reverse direction from process #3, which is the abnormal object, as the intrusion path.Furthermore, the attack identification unit 130 identifies process #4, process #5, and file #2, which are reached by tracing the edges in the forward direction from process #3, which is the abnormal object, as the contamination range.

[0025] The operation of the attack information analysis device 100 according to the first embodiment will be explained below using a flowchart.

[0026] 4, the operation of the attack information analysis device 100 to generate normal relational data will be described. First, the design data acquisition unit 140 acquires design data of the monitored device via the communication interface 103 (step S101). Next, the normal relational data generation unit 150 extracts operation data from the design data acquired by the design data acquisition unit 140 (step S102). In addition, the normal relational data generation unit 150 generates relational data from the operation data extracted from the design data, and stores the generated relational data in the memory 102 or the storage 104 as normal relational data indicating normal operation of the monitored device (step S103).

[0027] The operation of the attack information analysis device 100 to identify a cyber-attack will be described with reference to Figure 5. First, the log acquisition unit 110 acquires the log of the monitored device via the communication interface 103 (step S201). Next, the execution relationship data generation unit 120 extracts operation data from the acquired log (step S202). Furthermore, the execution relationship data generation unit 120 generates execution relationship data indicating the operations actually performed by the monitored device from the operation data extracted from the log, and updates the execution relationship data (step S203).

[0028] Thereafter, the attack identification unit 130 compares the execution relationship data with the normal relationship data (step S204), and as a result of the comparison between the execution relationship data and the normal relationship data, checks whether there are any elements (nodes or edges) that make up the execution relationship data that do not exist in the normal relationship data (step S205).

[0029] If all the nodes or edges that make up the execution relationship data exist in the normal relationship data (NO in step S205), it is determined that no attack has been made, and the process returns to step S201 to wait until the log acquisition unit 110 next acquires a log.

[0030] If any element constituting the execution relationship data does not exist in the normal relationship data (YES in step S205), the attack identification unit 130 determines that an attack has occurred. In this case, the attack identification unit 130 identifies a node that does not exist in the normal relationship data or a node that is the starting point of an edge as an abnormal object (step S206). Then, the attack identification unit 130 identifies, as an intrusion route, a range reached by tracing the edges included in the execution relationship data in the backward direction from the abnormal object (step S207). Furthermore, the attack identification unit 130 identifies, as a contaminated range, a range reached by tracing the edges included in the execution relationship data in the forward direction from the abnormal object (step S208).

[0031] As described above, the attack information analysis device 100 according to embodiment 1 can determine for itself whether a cyber attack has been made on a monitored device, and therefore can detect attacks and identify the intrusion route and the extent of contamination even if the monitored device does not have an attack detection function or if the monitored device's attack detection function is insufficient.

[0032] The attack information analysis device 100 can also be applied to, for example, an attack detection device that monitors a monitored device and notifies a user or other devices when it detects a cyber attack on the monitored device. This notification may include information on the intrusion route and contamination extent identified by the attack information analysis device 100.

[0033] <Embodiment 2> The configuration of the attack information analysis device 100 according to the second embodiment is the same as that of the attack information analysis device 100 (FIG. 1) according to the first embodiment. Below, differences from the first embodiment will be mainly described, and explanations that overlap with the first embodiment will be omitted.

[0034] The attack information analysis device 100 according to the second embodiment differs from the attack information analysis device 100 according to the first embodiment in that it assigns attributes to at least one of the nodes and edges of the generated relationship data (normal relationship data and execution relationship data). Attributes are data related to actions on objects. Specific examples of attributes include action type, communication source, communication destination, and action condition. Note that, although the specific example of relationship data shown below shows an example in which attributes are assigned to edges, attributes may also be assigned to nodes, or to both nodes and edges.

[0035] The normal relationship data generation unit 150 generates normal relationship data in which attributes are assigned to at least one of nodes and edges based on operation data extracted from the design data of the monitored device. FIG. 6 shows an example of normal relationship data 400 in which attributes are assigned. In the normal relationship data 400 in FIG. 6, an operation type attribute is assigned to each edge. The operation type is the type of operation on an object. Specific examples of operations on an object include start, run, write, and read.

[0036] The execution relationship data generation unit 120 generates execution relationship data in which attributes are assigned to at least one of nodes and edges based on operation data extracted from the logs of the monitored device. If execution relationship data already exists, the execution relationship data generation unit 120 updates the execution relationship data by adding the newly generated relationship data to the existing execution relationship data. FIG. 7 shows an example of execution relationship data 500 in which attributes are assigned. In the execution relationship data 500 in FIG. 7, an operation type attribute is also assigned to each edge.

[0037] The attack identification unit 130 compares the execution relationship data generated by the normal relationship data generation unit 150 with the normal relationship data generated by the execution relationship data generation unit 120, including attributes, to determine whether a cyber-attack has occurred on the monitored device. Specifically, the attack identification unit 130 determines that an attack has occurred on the monitored device if any of the elements constituting the execution relationship data does not exist in the normal relationship data. In this case, the attack identification unit 130 determines that even if elements appear to be the same (elements that appear the same ignoring attributes), they are different elements if their attributes are different. For example, even if an element in the execution relationship data and an element that appears to be the same exist in the normal relationship data, if the attributes of the two elements are different, the attack identification unit 130 determines that the element does not exist in the normal relationship data and determines that an attack has occurred on the monitored device.

[0038] The operation of the attack identification unit 130 to identify the intrusion route and contamination range of a cyber attack is the same as in the first embodiment.

[0039] For example, comparing the normal relationship data 400 in FIG. 6 with the execution relationship data 500 in FIG. 7, the attribute of the edge from process #3 to file #2 in the normal relationship data 400 is read, whereas the attribute of the edge from process #3 to file #2 in the execution relationship data 500 is write, and the attributes of the two are different. In other words, the edge with the attribute write from process #3 to file #2 in the execution relationship data 500 is an element that does not exist in the normal relationship data 400. When a node or edge that does not exist in the normal relationship data in this way exists in the execution relationship data, the attack identification unit 130 determines that an attack has been made on the monitored device.

[0040] The attack identification unit 130 also identifies process #3 in the execution relationship data 500 as the origin of an element (an edge with a right attribute from process #3 to file #2) that does not exist in the normal relationship data 400, as an abnormal object.The attack identification unit 130 then identifies process #2, file #1, and process #1, which are reached by tracing the edges in the reverse direction from process #3, the abnormal object, as the intrusion route.Furthermore, the attack identification unit 130 identifies process #4 and file #2, which are reached by tracing the edges in the forward direction from process #3, the abnormal object, as the contamination range.

[0041] The operation of generating normal relational data by the attack information analysis device 100 according to the second embodiment is represented by the flowchart in Fig. 4, similar to that of the first embodiment. However, in step S103, the normal relational data generation unit 150 generates normal relational data in which attributes are assigned to at least one of the nodes and edges.

[0042] Similarly to the first embodiment, the operation of the attack information analysis device 100 according to the second embodiment to identify a cyber-attack is represented by the flowchart in Fig. 5. However, in step S203, the execution relationship data generation unit 120 generates execution relationship data in which attributes are assigned to at least one of the nodes and edges. In addition, in steps S204 and S205, the attack identification unit 130 compares the execution relationship data with the normal relationship data, including the attributes, to determine whether or not a cyber-attack has occurred on the monitored device.

[0043] As described above, according to the attack information analysis device 100 according to the second embodiment, the attributes of actions taken on objects are added as factors for determining whether an attack has been made on a monitored device. This makes it possible to detect attacks with higher accuracy.

[0044] <Third Embodiment> The configuration of the attack information analysis device 100 according to embodiment 3 is the same as that of the attack information analysis device 100 (FIG. 1) according to embodiment 1. Below, differences from embodiment 1 will be mainly described, and explanations that overlap with embodiment 1 will be omitted.

[0045] The attack information analysis device 100 of embodiment 3 differs from the attack information analysis device 100 of embodiment 1 in that it uses operation data obtained from the log of the monitored device when generating normal relationship data for the monitored device.

[0046] With reference to FIG. 8, the operation of generating normal relation data by the attack information analysis device 100 according to the third embodiment will be described.

[0047] First, the design data acquisition unit 140 acquires design data of the monitored device via the communication interface 103 (step S301). Next, the normal relationship data generation unit 150 extracts operation data from the design data acquired by the design data acquisition unit 140 (step S302). Furthermore, the normal relationship data generation unit 150 generates relationship data from the operation data extracted from the design data, and stores the generated relationship data in the memory 102 or the storage 104 as normal relationship data indicating normal operation of the monitored device (step S303). These steps S301 to S303 correspond to steps S101 to S103 in FIG. 4.

[0048] Furthermore, the log acquisition unit 110 acquires the log of the monitored device via the communication interface 103 (step S304). Next, the execution relationship data generation unit 120 extracts operation data from the acquired log (step S305). Furthermore, the execution relationship data generation unit 120 generates execution relationship data indicating the operations actually performed by the monitored device from the operation data extracted from the log, and updates the execution relationship data (step S306). These steps S304 to S306 correspond to steps S201 to S203 in FIG. 5.

[0049] The execution relationship data generating unit 120 repeats the processes of steps S304 to S306 until a predetermined time has elapsed (step S307).

[0050] Thereafter, the normal relationship data generating unit 150 adds the execution relationship data generated by the execution relationship data generating unit 120 in step S307 to the normal relationship data generated in step S303 (step S308). The normal relationship data to which this execution relationship data has been added becomes the final normal relationship data.

[0051] The operation of the attack information analysis device 100 according to the third embodiment to identify a cyber-attack is the same as that according to the first embodiment.

[0052] The second embodiment may be applied to the third embodiment, and attributes may be assigned to at least one of the nodes and edges of the normal relationship data generated in step S303 and the execution relationship data generated in step S307. In this case, the operation of the attack information analysis device 100 to identify a cyber-attack will be the same as in the second embodiment.

[0053] As described above, the attack information analysis device 100 according to the third embodiment can generate sufficient normal relationship data even when the design data is insufficient by reflecting the execution relationship data in the normal relationship data, thereby making it possible to detect attacks without reducing accuracy.

[0054] It is possible to freely combine the embodiments, and to modify or omit the embodiments as appropriate.

[0055] <Additional Notes> Various aspects of the present disclosure are summarized below as appendices.

[0056] (Appendix 1) a design data acquisition unit that acquires design data of a monitoring target device; a normal relationship data generation unit that extracts, from the design data of the monitored device, operation data that indicates operations that affect other objects, and generates, based on the operation data extracted from the design data, normal relationship data that indicates normal operation of the monitored device, the normal relationship data being a directed graph consisting of nodes that represent objects and edges that point from affecting objects to affected objects; a log acquisition unit that acquires a log of the monitoring target device; an execution relationship data generation unit that extracts the operation data from the log of the monitoring target device and generates, based on the operation data extracted from the log, execution relationship data that indicates operations actually executed by the monitoring target device, which is the directed graph; an attack identification unit that compares the execution relationship data with the normal relationship data, and if any of the nodes and edges constituting the execution relationship data does not exist in the normal relationship data, determines that an attack has been made on the monitored device, and identifies the intrusion route and contamination extent of the attack; Equipped with the attack identification unit identifies the node that exists in the execution relationship data and does not exist in the normal relationship data and the node that is the origin of the edge as an abnormal object, identifies the intrusion route by tracing the edge in a backward direction from the abnormal object, and identifies the contamination range by tracing the edge in a forward direction from the abnormal object. Attack information analysis device.

[0057] (Appendix 2) the normal relationship data generation unit and the execution relationship data generation unit assign attributes related to actions on objects to at least one of the nodes and the edges of the execution relationship data and the normal relationship data, the attack identification unit compares the execution relationship data with the normal relationship data, including the attributes assigned to the nodes and edges; 2. The attack information analysis device according to claim 1.

[0058] (Appendix 3) the normal relationship data generation unit adds the execution relationship data generated within a predetermined time to the normal relationship data. 10. The attack information analysis device according to claim 1 or 2. [Explanation of symbols]

[0059] 100 Attack information analysis device, 101 Processor, 102 Memory, 103 Communication interface, 104 Storage, 110 Log acquisition unit, 120 Execution relationship data generation unit, 130 Attack identification unit, 140 Design data acquisition unit, 150 Normal relationship data generation unit, 200 Normal relationship data, 300 Execution relationship data, 400 Normal relationship data with attributes assigned, 500 Execution relationship data with attributes assigned.

Claims

1. a design data acquisition unit that acquires design data of a monitoring target device; a normal relationship data generation unit that extracts, from the design data of the monitored device, operation data that indicates operations that affect other objects, and generates, based on the operation data extracted from the design data, normal relationship data that indicates normal operation of the monitored device, the normal relationship data being a directed graph consisting of nodes that represent objects and edges that point from affecting objects to affected objects; a log acquisition unit that acquires a log of the monitoring target device; an execution relationship data generation unit that extracts the operation data from the log of the monitoring target device and generates, based on the operation data extracted from the log, execution relationship data that indicates operations actually executed by the monitoring target device, which is the directed graph; an attack identification unit that compares the execution relationship data with the normal relationship data, and if any of the nodes and edges constituting the execution relationship data does not exist in the normal relationship data, determines that an attack has been made on the monitored device, and identifies the intrusion route and contamination extent of the attack; Equipped with the attack identification unit identifies the node that exists in the execution relationship data and does not exist in the normal relationship data and the node that is the origin of the edge as an abnormal object, identifies the intrusion route by tracing the edge in a backward direction from the abnormal object, and identifies the contamination range by tracing the edge in a forward direction from the abnormal object. Attack information analysis device.

2. the normal relationship data generation unit and the execution relationship data generation unit assign attributes related to actions on objects to at least one of the nodes and the edges of the execution relationship data and the normal relationship data, the attack identification unit compares the execution relationship data with the normal relationship data, including the attributes assigned to the nodes and edges; The attack information analysis device according to claim 1 .

3. the normal relationship data generation unit adds the execution relationship data generated within a predetermined time to the normal relationship data. The attack information analysis device according to claim 1 or 2.

Images