Information processing device, program, and information processing method

Abstract

It can also detect unknown attacks. [Solution] The information processing device comprises: an acquisition unit that acquires access request information including multiple elements; an integration process that sets one or more analysis targets for each of the multiple access request information by setting one or more of the values ​​as analysis targets for each element, according to at least one of the values ​​of each element, the frequency of occurrence of the values, and the number of types of values; an analysis process that analyzes the formal attributes of the values ​​included in the analysis targets for each analysis target; and a setting process that sets an acceptance criterion for the elements based on the analyzed formal attributes, thereby creating a format for the access request information.

Description

[Technical Field]

[0001] The present invention relates to an information processing apparatus, a program, and an information processing method. [Background Art]

[0002] In recent years, various web applications have been provided via the Internet. On the other hand, with the popularization and expansion of services, cyberattacks targeting web applications have been increasing. Various methods of cyberattack are known, such as SQL (Structured Query Language) injection and OS (Operating System) command injection.

[0003] Conventionally, a method of responding to cyberattacks on these web applications using a WAF (Web Application Firewall) is known (see, for example, Patent Document 1). As one type of WAF, there is a technology that detects attacks and blocks communications by creating a pattern file (blacklist) using data strings of cyberattacks conducted in the past and performing matching. [Prior Art Documents] [Patent Documents]

[0004] [Patent Document 1] Japanese Unexamined Patent Publication No. 2005-134972 [Summary of the Invention] [Problem to be Solved by the Invention]

[0005] However, existing WAFs (Web Application Firewalls) create pattern files using data sequences from past attacks and perform matching based on this method; therefore, by their very nature, they cannot deal with unknown attacks (zero-day attacks). Furthermore, existing WAFs can be completely bypassed by using attacks that automatically generate a variety of slightly different attacks using artificial intelligence (AI).

[0006] Therefore, the present invention has been made in view of the above points, and aims to provide a technology that can detect even unknown attacks. [Means for solving the problem]

[0007] One aspect of the present invention is an information processing device comprising: an acquisition unit that acquires access request information including a plurality of elements; an integration process that sets one or more of the values ​​of each element as a single analysis target for each of the plurality of access request information, by setting one or more of the values ​​as a single analysis target according to at least one of the values ​​of each element, the frequency of occurrence of the values, and the number of types of the values; an analysis process that analyzes the formal attributes of the values ​​included in the analysis target for each of the analysis targets; and a setting process that sets an acceptance criterion for the values ​​based on the analyzed formal attributes, thereby creating a format for the access request information.

[0008] Furthermore, in one embodiment of the present invention, the format creation unit sets the target of analysis by assigning to the multiple types of values ​​a key of at least one of the multiple types of keys, the key which is determined according to at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of values.

[0009] Furthermore, in one embodiment of the present invention, the format creation unit assigns a first key to all of the element values ​​when the overlap rate based on the number of types of values ​​and the number of access request information is less than or equal to a predetermined value, thereby setting them as one of the analysis targets, and sets the acceptance criteria for the first key based on the formal attributes of the value to which the first key is assigned.

[0010] Furthermore, in one embodiment of the present invention, if the number of types of values ​​is greater than or equal to a predetermined value, the format creation unit assigns a second key to the values ​​of the elements whose values ​​based on their frequency of appearance are less than or equal to a predetermined value, thereby setting them as one of the analysis targets, and sets the acceptance criteria for the second key based on the formal attributes of the values ​​to which the second key is assigned.

[0011] Furthermore, in one embodiment of the present invention, the format creation unit assigns a third key to the values ​​of the elements whose values ​​based on frequency of occurrence are above a predetermined level, thereby setting them as one of the analysis targets; sets the tolerance criteria for the third key based on the formal attributes of the value to which the third key is assigned; and sets the value to which the third key is assigned itself as the tolerance criteria for the value.

[0012] Furthermore, in one embodiment of the present invention, the information processing device further includes a determination unit that determines that access to the server by the access request information is normal when the access request information to the server conforms to the acceptance criteria for each element included in the format created by the format creation unit.

[0013] Furthermore, one aspect of the present invention is a program that causes a computer to execute an acquisition step of acquiring access request information including a plurality of elements; an integration process of setting one or more of the values ​​of each element as a single analysis target for each of the plurality of access request information, by setting one or more of the values ​​as a single analysis target according to at least one of the values ​​of each element, the frequency of occurrence of the values, and the number of types of values; an analysis process of analyzing the formal attributes of the values ​​included in the analysis target for each of the analysis targets; and a setting process of setting an acceptance judgment criterion for the element based on the analyzed formal attributes, thereby creating a format for the access request information.

[0014] Furthermore, one aspect of the present invention is an information processing method that includes: an acquisition step of acquiring access request information including a plurality of elements; an integration process of setting one or more analysis targets for each of the values ​​of each element of the plurality of access request information by setting one or more of the values ​​as a single analysis target for each element according to at least one of the values ​​of each element, the frequency of occurrence of the values, and the number of types of values; an analysis process of analyzing the formal attributes of the values ​​included in the analysis target for each of the analysis targets; and a setting process of setting an acceptance judgment criterion for the element based on the analyzed formal attributes, thereby creating a format for the access request information. [Effects of the Invention]

[0015] According to the present invention, even unknown attacks can be detected. [Brief explanation of the drawing]

[0016] [Figure 1] This is a block diagram illustrating an example configuration of the information processing system 1 according to the embodiment. [Figure 2] This is a block diagram illustrating an example of the functional configuration of the information processing device 10 according to the embodiment. [Figure 3]It is a diagram illustrating an example of preprocessing performed by the format creation unit 12. [Figure 4] It is a diagram illustrating an example of access request information A converted by the format creation unit 12. [Figure 5] It is a diagram for explaining integration processing and analysis processing performed by the format creation unit 12. [Figure 6] It is a flowchart for explaining an example of the processing flow of the information processing apparatus 10 according to the embodiment. [Figure 7] It is a diagram schematically illustrating an example of the hardware configuration of an information processing apparatus 90 applied to the embodiment. Mode for Carrying Out the Invention

[0017] Embodiment Preferred embodiments of the information processing apparatus, program, and information processing method according to the present embodiment will be described in detail below with reference to the accompanying drawings. In the description of the drawings, the same or similar reference numerals are assigned to the same or similar parts. The present embodiment is not limited to these embodiments, and also includes embodiments with various modifications or improvements. In other words, the components described below include those that can be easily conceived by those skilled in the art and those that are substantially identical, and the components described below can be combined as appropriate. Further, in the present embodiment, various omissions, substitutions, or alterations of components may be made without departing from the gist of the present invention. In all the drawings for describing the embodiments, the same reference numerals are used for components having the same functions, and repeated description is omitted. In addition, the expression "based on XX" as used in the present application means "based on at least XX", and includes cases where it is based on another element in addition to XX. Further, "based on XX" is not limited to the case where XX is directly used, and also includes cases where it is based on a product obtained by performing calculation or processing on XX. "XX" is any arbitrary element (e.g., any arbitrary information). Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0018] Configuration Example of Information Processing System Figure 1 is a block diagram for explaining a configuration example of an information processing system 1 according to an embodiment. The information processing system 1 includes an information processing apparatus 10, a terminal 20, and a downstream server 30. For explanation purposes, an example in which one terminal 20 is connected to one information processing apparatus 10 is shown in FIG. 1, but a plurality of terminals 20 may be connected to one information processing apparatus 10. When there is no particular distinction between the case where there is one terminal 20 and the case where there are a plurality of terminals 20, they may be simply referred to as the terminal 20. Similarly, a plurality of downstream servers 30 may be connected to one information processing apparatus 10.

[0019] The information processing apparatus 10 and the terminal 20 are communicatively connected via a network N1. Further, the information processing apparatus 10 and the downstream server 30 are communicatively connected via a network N2. The network N1 and the network N2 may be networks using wireless communication or networks using wired communication. The network N1 and the network N2 may be configured using, for example, the Internet, or may be configured using a local area network (LAN). The network N1 and the network N2 may be configured by combining a plurality of networks.

[0020] The information processing apparatus 10 acquires an access to the downstream server 30 from the terminal 20, and determines whether to forward the access to the downstream server 30 or block the access. That is, the information processing apparatus 10 relays access from the terminal 20 to the downstream server 30. The terminal 20 is operated by a user. The terminal 20 is, for example, an information processing apparatus such as a personal computer, a tablet, or a smartphone, and includes a browser for browsing websites provided by the downstream server 30. The terminal 20 is, for example, a user terminal that accesses a site. The downstream server 30 is an information processing apparatus that provides a website to the terminal 20 in accordance with an access request from the terminal 20. The downstream server 30 is originally the server that should receive access from the terminal 20.

[0021] [Functions of Information Processing Apparatus] Figure 2 is a block diagram illustrating an example of the functional configuration of an information processing device 10 according to an embodiment. The information processing device 10 includes an acquisition unit 11, a format creation unit 12, a determination unit 13, and an output unit 14 as its functional units. Each of these functional units may be implemented using electronic circuits as needed. Furthermore, each functional unit does not have to be included in a single device, and the information processing device 10 may be configured from multiple devices.

[0022] [Format creation stage] First, while explaining the acquisition unit 11 and the format creation unit 12, we will describe the method of creating the format F of access request information A from the access request information A. The format F of access request information A is information that indicates the formal attributes of access request information A.

[0023] The acquisition unit 11 acquires access request information A. The acquisition unit 11 may also be called the input unit because it acquires access request information A that is input to the information processing device 10. Access request information A is information relating to an access request from terminal 20 to subsequent server 30. Access request information A includes multiple elements M. Elements M are, for example, domain, path, and query, or further subdivisions of these. The acquisition unit 11 may acquire access request information A from terminal 20 in real time, or it may acquire a log of access request information A from a server or the like that stores access request information A output from one or more terminals 20. The acquisition unit 11 may also store the access request information A acquired from terminal 20 in a storage unit or the like. The acquisition unit 11 may also be called the log acquisition unit.

[0024] The format creation unit 12 acquires multiple access request information A from the acquisition unit 11 and a storage unit (not shown), etc. Based on the acquired access request information A, the format creation unit 12 creates a format F for the access request information A. Multiple access request information A refers to, for example, access request information A for a predetermined period (e.g., 1 hour) or a predetermined number (e.g., 10,000 times). The predetermined period and predetermined number may be set in advance by the designer or administrator of the information processing device 10.

[0025] [Format creation stage: Preprocessing] The format creation unit 12 performs preprocessing on the access request information A. The format creation unit 12 decomposes the access request information A into elements M, such as domain, path, and query, or further subdivided elements M. Furthermore, the format creation unit 12 may, for example, flatten the hierarchical data format. This unifies the data format of the access request information A into a simple structure, making it easier to create format F. The above-mentioned decomposition and flattening are sometimes referred to as preprocessing.

[0026] Figure 3 shows an example of preprocessing performed by the format creation unit 12. For example, if the data description method of access request information A is "JSON (JavaScript Object Notation)", the format creation unit 12 converts it into a key-value map KVM by deconstructing and flattening the hierarchical structure (key-value tree map KVTM). In addition, if access request information A can be decoded by "Base64" or the like, it is decoded. If access request information A is encoded by "www-form-url-encoded", it is decoded and converted into a key-value map KVM. If the data description method of access request information A is "url-query", it is decoded and converted into a key-value map KVM. Furthermore, if access request information A contains a regular expression such as "a-zA-Z0-9+ / -_!:.", it is split by ".".

[0027] By performing the preprocessing described above, the access request information A is converted into a predetermined data description format. Figure 4 shows an example of access request information A converted by the format creation unit 12. Hereinafter, the process for creating format F will be explained using the case where multiple access request information A are converted into the data description format shown in Figure 4 as an example. In Figure 4, access request information A includes elements M1 to M7. The format creation unit 12 creates format F of access request information A by performing integration processing and analysis processing for each element M of the multiple access request information A.

[0028] [Format creation stage: Integration process] The format creation unit 12 performs integration processing on multiple access request information A. Each element M has a value. The value is the information that element M possesses and is not limited to numbers. Element M can be any string, for example, it may be a number, a symbol, or an alphabet. For example, in Figure 4, the second element M2 has the value "newsroom". For example, when analyzing the formal attributes of element M, such as whether or not it is the last value, the format creation unit 12 sets the value to be analyzed. For example, the value to be analyzed may be "values ​​that are the same". Integration processing is the process of managing multiple values ​​together as an analysis target. In integration processing, one or more types of values ​​are integrated and managed as a single analysis target, depending on each value, its frequency of occurrence, and the number of types of values. The format creation unit 12 integrates and manages by setting one or more values ​​as a single analysis target, for example.

[0029] During the integration process, the format creation unit 12 may attach integration information to each value that the multiple access request information A has in the element M to be processed, indicating that they are the same analysis target. The integration information is stored separately from the value, for example. The integration information may also be called a key. Furthermore, if the analysis target does not contain different types of values, that is, if the analysis target contains only one type of value, the format creation unit 12 may attach that value as integration information. In the following description, the integration information attached when the analysis target contains different types of values ​​may be called an integration key (such as the any key described later). On the other hand, the integration information attached when the analysis target does not contain different types of values ​​may be called a specified key.

[0030] Furthermore, if element M has a value-key pair before the integration process, the format creation unit 12 may replace the key to be integrated with integration information, or it may assign the integration information separately from the key. For example, if the second element M2 has a value "newsroom" and a key similar to the value, "specified key "newsroom"", before the integration process, the format creation unit 12 may replace the key with an integration key during integration, or it may assign it separately from "specified key "newsroom"". Also, if only those with the value "newsroom" are to be analyzed, the format creation unit 12 may retain the specified key without assigning an integration key. This makes it possible to manage each value included in a single analysis target.

[0031] There are several types of integrated keys set by the format creation unit 12. The format creation unit 12 determines which integrated key to adopt based on the respective values ​​and the frequency of their occurrence.

[0032] [Integration Key: any key] The integration key includes the `any` key. The `any` key is set for access request information A where the values ​​of element M hardly overlap. The values ​​set for the `any` key are, for example, machine-generated values, and often have a defined formal attribute (format), making it easy to analyze (predict) the format trends. The values ​​integrated by setting the `any` key are highly random, such as tokens, usernames, and timestamps.

[0033] The `any` key is a unification key that combines values ​​that often differ with each access. Therefore, the ability to set the `any` key is determined based on the overlap rate of values ​​in multiple access request information A. The overlap rate is calculated based on the number of different values ​​that appear in the element M being processed (number of key values) and the number of access request information A (number of analysis samples). For example, the `any` key is set if the ratio of the number of access request information A to the number of different values ​​that appear in the element M being processed (overlap rate) is below a predetermined value. The number of each value type can be easily measured by determining whether or not the value has appeared in the past, and by increasing the count of the "number of value types" held if it has not appeared before. The number of access request information A can also be easily measured by counting the number of access request information A used by the format creation unit 12 to create format F. Furthermore, these values ​​can be easily updated by continuing measurement even if the number of access request information A used to create format F changes. Therefore, the overlap rate can be easily calculated using these two values.

[0034] The format creation unit 12 integrates all values ​​appearing in the element M to be processed into the any key, for example, if the overlap rate is below a predetermined value. The predetermined value that serves as the threshold for the overlap rate may be, for example, 2. That is, if the overlap rate is such that each value does not overlap twice, each value may be estimated to be a highly random machine-generated value and integrated into the any key. Values ​​that hardly overlap are highly random, and even if a specified key is set for each value, they are unlikely to match the unknown access request information A. Furthermore, since mismatches can occur in both normal and abnormal accesses, they are unlikely to be used as format F. Therefore, when creating the any key, it is desirable to treat all values ​​appearing in the element M to be processed as a single analysis target and not set a specified key. The predetermined value may be determined in advance by the designer or administrator of the information processing device 10.

[0035] Figure 5 is a diagram illustrating the integration and analysis processes performed by the format creation unit 12. Referring to Figure 5, the case where the data is integrated into the `any` key, one of the integration keys, will be explained. In Figure 5, the format creation unit 12 uses multiple access request information A, from the first access request information A1 to the nth access request information An, to create format F. In Figure 5, the element M to be processed is the seventh element M7, and the value of the seventh element M7 is a parameter indicating time. Therefore, the value of the seventh element M7 is a machine-generated value that is unlikely to be duplicated. Thus, the value of the seventh element M7 of the access request information A is integrated into the `any` key and managed as a single analysis target.

[0036] [Integrated key: rest key] Furthermore, the integration key includes the `rest` key. The `rest` key is set for values ​​that may have duplicates but have a sufficiently large number of unique values. Values ​​integrated by setting the `rest` key include, for example, strings related to content dynamically added by users. Values ​​set to the `rest` key are, for example, user-generated and publicly available values, making it easier to parse formal attributes (restrictions) such as character type. Values ​​integrated by setting the `rest` key include, for example, site names, which can be dynamically added by users.

[0037] Since the rest key is an integration key that integrates values ​​that can be dynamically added by the user, it is preferable to determine whether or not to set the rest key based on the number of different value types. For example, the rest key is set if the number of different value types appearing in the element M to be processed is greater than or equal to a predetermined value. The predetermined value that serves as the threshold for whether or not to set the rest key may be, for example, a sufficiently large value (e.g., 100) based on the access request information A. If the threshold is greater than 100, the likelihood of compliance decreases, and it may become impractical. Alternatively, the predetermined value may be, for example, the ratio of the number of different value types to the access request information A. Note that the predetermined value may be set in advance by the designer or administrator of the information processing device 10.

[0038] The format creation unit 12 integrates values ​​that appear in the element M to be processed and whose values ​​based on frequency are below a predetermined level into the rest key. In other words, it integrates values ​​with low frequency into the rest key. The value based on frequency may be the frequency of occurrence itself. If it is the frequency of occurrence itself, the threshold may be the number of occurrences. Alternatively, the value based on frequency may be a value indicating the frequency of occurrence. The value indicating the frequency of occurrence may be, for example, the rank indicating the frequency of occurrence of each type of value. If it is the rank of the frequency of occurrence of each type of value, the threshold may be the rank, for example, values ​​of the type that are in the bottom 10% of the rankings according to their frequency of occurrence may be the target of analysis. The predetermined value that serves as the threshold for the value based on frequency of occurrence may be predetermined by the designer or administrator of the information processing device 10.

[0039] In other words, the format creation unit 12 retains some values ​​that receive a lot of traffic, such as site names, as specified keys, while integrating other values ​​that receive less traffic into the rest key. This allows values ​​that receive a lot of traffic to be used as the structure of format F, while values ​​that do not receive a lot of traffic can have their formal attributes used as the structure of format F. Since the values ​​that are to be integrated into the rest key are publicly available values, they are susceptible to attacks. By not integrating frequently occurring values ​​into the rest key and instead retaining the values ​​themselves as specified keys, the checking standards for format F are maintained at a high level.

[0040] [Integrated Key: all key] Furthermore, the integration keys include the `all` key. The `all` key is set for very rare instances of special patterns that are accessed only once every few days. Values ​​integrated by setting the `all` key include, for example, user-generated and confidential values—values ​​entered by the user but rarely seen by other users. Examples of values ​​integrated by setting the `all` key include account names.

[0041] The `all` key is an integrated key for handling special input patterns and is a non-public value that is less likely to be targeted by attacks, so it is sufficient to grasp the general trend. Therefore, the `all` key integrates (analyzes) the main components of the values ​​that appear in element M of the processing response, for example. The determination of whether or not it is a main component may be made using a value based on the frequency of appearance, for example. The format creation unit 12 may make the determination according to the rank according to the frequency of appearance, similar to the `rest` key, for example, it may analyze the values ​​of the types that rank in the top 50% (the total number is the number of types of values). Furthermore, the format creation unit 12 does not have to make the determination of whether or not it is a main component for each type of value. The format creation unit 12 may, for example, analyze the values ​​that are in the bottom 10% when each value is arranged in order of frequency of appearance (the total number is the number of access request information A). In other words, the format creation unit 12 analyzes the basic patterns that appear in element M by integrating the main components of the values ​​and making them the target of analysis. This makes it possible to create a format F that can appropriately determine whether or not there is an attack even when a special pattern different from the usual is input.

[0042] In the case of the any key and rest key, the values ​​to be merged are infrequently occurring and difficult to use as format F. Therefore, when the any key and rest key are present, it is preferable not to include a specified key, or to replace the specified key if one is already present. On the other hand, in the case of the all key, the values ​​to be merged are frequently occurring and are the main components of element M, making them easy to use as format F. Therefore, even when the all key is present, it is preferable to include a specified key, or to include it separately from the specified key if one is already present.

[0043] According to the integration process described above, at least one of an integration key and a specified key can be assigned to every value appearing in the element M being processed. The specified key is a string used for special functions directly created by the programmer or other user. Since inputting values ​​other than those used may create vulnerabilities, it is desirable to not allow anything other than fixed values. Therefore, the specified key is used to analyze only one value, not multiple values. The specified key, any key, rest key, and all key are assigned according to the characteristics of values ​​that actually appear when the program is running, and therefore these keys can handle various values ​​included in the access request information A. The specified key, any key, rest key, and all key are just examples of integration keys, and other integration keys may also exist. Furthermore, there may be fewer than three types of integration keys, or three or more types.

[0044] [Format creation stage: Analysis process] The format creation unit 12 analyzes the formal attributes of the values ​​included in each analysis target. An analysis target is a value to which the same integrated information is attached, and is a value included in the same specified key, any key, rest key, or all key. If a single value is set as multiple analysis targets, that value is used for the analysis of each key.

[0045] In Figure 5, the values ​​of the seventh element M7 of multiple access request information A are assigned the key "any" and are treated as a single target for analysis. The format creation unit 12 analyzes the formal attributes based on the values ​​assigned the key "any," that is, all the values ​​that appear in the seventh element M7 of the first access request information A1 to the nth access request information An.

[0046] Formal attributes are characteristic patterns of values ​​that appear, and may include, for example, what kinds of values ​​appear, or where they appear within access request information A. For example, the format creation unit 12 may analyze "existence or non-existence of a value," "range of data length," and "type of character class" as formal attributes of a value. The three types of formal attributes described above are just examples, and this embodiment is not limited to this example.

[0047] [Format creation stage: Configuration process] The format creation unit 12 sets the tolerance criterion VF based on the analyzed formal attributes. The tolerance criterion VF is the criterion for determining whether to allow element M of the unknown access request information A. The format creation unit 12 sets the tolerance criterion VF for the passage of element M from the probabilistic numerical value of the occurrence of a certain formal attribute value. That is, the format creation unit 12 sets the tolerance criterion VF from the regularity of when a certain value appears, based on the values ​​included in the analysis target. For example, the format creation unit 12 may set the tolerance criterion VF using a formal attribute with a probability greater than 0 (one that has appeared at least once). The setting of the tolerance criterion VF will be explained using the following formal attribute as an example.

[0048] "Existence or non-existence of a value" refers, for example, to whether a value exists immediately following the target value in access request information A, that is, whether the value is at the end or not. The format creation unit 12 analyzes the "existence or non-existence of a value" for each value included in the analysis target. The format creation unit 12 analyzes the formal attribute of "existence or non-existence of a value" by measuring the number of values ​​that were at the end and the number of values ​​that were not at the end for each value in the analysis target. If all the values ​​included in the analysis target are at the end, the format creation unit 12 sets an acceptable judgment criterion VF that "the next value does not necessarily exist". On the other hand, if not all the values ​​included in the analysis target are at the end, the format creation unit 12 sets an acceptable judgment criterion VF that "the next value definitely exists". Furthermore, if some of the values ​​included in the analysis target are at the end and some of the values ​​included in the analysis target are not at the end, the format creation unit 12 sets an acceptable judgment criterion VF that "it is unclear whether the next value exists".

[0049] The "data length range" refers to, for example, the range of possible data lengths for a value. The format creation unit 12 analyzes the "data length" for each value included in the analysis target. The format creation unit 12 identifies the data length for each value included in the analysis target and, by retaining the longest and shortest data lengths, sets an acceptable judgment criterion VF called the "data length range" for the values ​​included in the analysis target. The format creation unit 12 may also perform predetermined processing on the retained data lengths. For example, the format creation unit 12 may set the acceptable judgment criterion VF for the "data length range" to be a value with a margin of ±1 over the data length represented by "log_2". Specifically, the format creation unit 12 may define the "data length range" as the range between "shortest data length - 1" and "longest data length + 1".

[0050] "Character class type" refers to the type of character class (character type) of characters and symbols included in a string. Character classes include various character types such as alphabets, numbers, symbols, and whitespace characters. For example, the format creation unit 12 analyzes the "character class" included in each value included in the analysis target. The format creation unit 12 also maintains the type of character class identified as being included, and sets one or more character classes included in any of the values ​​within the analysis target as the "character class type" tolerance criterion VF. The above setting of the tolerance criterion VF is performed for the rest key, all key, and specified key. Note that for the specified key, since the analysis target is the same value, the tolerance criterion VF may be treated as whether it is the value itself.

[0051] The format creation unit 12 creates the format F of the access request information A by performing the aforementioned integration, analysis, and setting processes for each element M. For example, let's explain the creation of format F using the case where a specified key, any key, rest key, and all key are set for a certain element M. The format creation unit 12 performs integration, analysis, and setting processes on the value that appears after the value to which the specified key is attached (the same value as the specified key) (the value of the next element M), and links the higher-level key with the key of the next element M of the higher-level key (the lower-level key). The format creation unit 12 also performs the same processing for the any key, rest key, and all key as for the specified key. In this way, the format creation unit 12 creates a tree-like format F in which a certain key is linked to the keys that are likely to appear next to that key. Format F shows the acceptance criteria VF of the access request information A, and is an analysis of what kind of values ​​the input access request information A will take. The format creation unit 12 may store the created format F in the storage unit or output it externally. Note that linking means either attaching relationship information to both the higher-level key and the lower-level key and storing them, or storing the higher-level key and the lower-level key in an array-type data structure.

[0052] In format F, for each key of the higher-level element M, the lower-level element M is set to a separate key. For example, in format F, the second element M2 may be set to the keys "A1", "A2", and "A3" associated with the key "A" of the first element M1, and the second element M2 may be set to the keys "B1", "B2", and "B3" associated with the key "B" of the first element M1. Note that A1 to A3 and B1 to B3 do not necessarily have to be different keys or acceptance criteria VF; they may be the same.

[0053] [Evaluation stage] The acquisition unit 11 acquires access request information A from the terminal 20. The determination unit 13 acquires access request information A by referring to the storage unit. The determination unit 13 performs the same preprocessing on the new access request information A as the format creation unit 12. The determination unit 13 compares the new access request information A with format F. If the new access request information A conforms to format F, the determination unit 13 determines that the access to the subsequent server 30 by access request information A is normal, i.e., not an attack. The output unit 14 outputs (transfers) the access request information A, which has been determined to be normal, to the subsequent server 30, which is the access destination. On the other hand, if the new access request information A does not conform to format F, the determination unit 13 determines that the access to the subsequent server 30 by access request information A is not normal, i.e., it is an attack or malicious. The output unit 14 blocks the access request information A, which has been determined to be not normal, and does not output it to the subsequent server 30, which is the access destination. An example of determining whether or not it conforms to format F will be explained in detail. In this example, format F will be described as one that uses a structure where each element M is connected. Format F is a format in which various patterns are provided in a tree structure from the first element M1 down to the lower-level elements M.

[0054] [Judgment: Specified Key] The determination unit 13 determines that the value of the element M to be determined for conformance in the access request information A is conforming if it matches the specified key of the element M referenced in format F, and then proceeds to determine the next element M.

[0055] [Judgment: Integrated Key] If the value of access request information A does not match the specified key in format F, the determination unit 13 determines that the value of the target element M is compatible if an integrated key is set for the referenced element M, and the formal attributes of the value of the element M to be judged for compatibility in access request information A satisfy the acceptable judgment criterion VF of that integrated key, and then performs the judgment on the next element M. In other words, integrated keys such as the any key, rest key, and all key act as wildcards, and even if the string does not match, compatibility is determined if the acceptable judgment criterion VF is satisfied. If the determination unit 13 does not determine that there is a match with either the specified key or the integrated key, it determines that the value of the target element M is not compatible and performs the judgment process on other keys of the higher-level element M. The determination unit 13 determines that the access request information A that has passed (matched) up to the last element M of format F is a normal access. For example, if new access request information A is decomposed into seven elements from the first element M1 to the seventh element M7, the judgment process is performed at least seven times to determine whether each seventh element M7 conforms to format F. The determination unit 13 determines that access request information A that failed to pass format F is an abnormal access.

[0056] [Processing flow of information processing equipment] Figure 6 is a flowchart illustrating an example of the processing flow of the information processing device 10 according to this embodiment. The processing flow performed by the information processing device 10 will be explained with reference to this figure.

[0057] (Step S101) The information processing device 10 acquires a predetermined number (e.g., 10,000) or a predetermined period (e.g., 1 hour) of access request information A. The information processing device 10 may acquire multiple access request information A stored as logs, or it may store the acquired access request information A in a storage unit for reference when creating format F. The stored access request information A may be the content of the access request information A itself, or it may be stored after being broken down into its respective elements M (values). When it is stored after being broken down into its respective values, the information processing device 10 measures the frequency of occurrence of each value. For example, if there is a value in the acquired access request information A that has appeared before, the information processing device 10 may add the value of a variable indicating the frequency of occurrence of that value. This reduces the amount of information when storing logs and further reduces the computation time required for integration processing.

[0058] (Step S102) The information processing device 10 performs integration processing and analysis processing for each element M. The information processing device 10 integrates the values ​​that appear through the integration processing and sets the analysis target in a way that facilitates analysis. The information processing device 10 also analyzes the formal attributes of the values ​​included in the analysis target by performing the analysis processing. By performing this processing for each element M and setting the acceptance criteria, the information processing device 10 creates the format F of the access request information A.

[0059] (Step S103) The information processing device 10 obtains new (unknown) access request information A from the access source terminal 20. The destination of this access request information A is the subsequent server 30.

[0060] (Step S104) The information processing device 10 determines whether the new access request information A conforms to the created format F. Specifically, the information processing device 10 determines whether the value contained in the access request information A matches the specified key contained in format F, or whether it satisfies the acceptance criteria VF for the integrated key contained in format F.

[0061] (Step S105) If the new access request information A conforms to format F (Step S104; Yes), the information processing device 10 determines that the new access request information A is a normal access and outputs it to the subsequent server 30. As a result, terminal 20 that performs a normal access can access the subsequent server 30.

[0062] (Step S106) If the access request information A does not conform to format F (Step S104; No), the information processing device 10 determines that the new access request information A is an abnormal access and does not output it to the subsequent server 30. As a result, the terminal 20 making the abnormal access cannot access the subsequent server 30.

[0063] In Figure 6, the stage of creating format F and the stage of determining access request information A are shown separately and independently. However, this embodiment is not limited to this example, and the stage of creating format F and the stage of determining access request information A do not necessarily have to be clearly distinguished. For example, when the information processing device 10 acquires new access request information A, it may determine whether the access request information A is compatible with the already created format F, and store the access request information A in the storage unit for the creation of format F. In other words, steps S101 and S103 may be the same process.

[0064] Furthermore, if the creation of format F is not yet complete, for example, if sufficient information has not been obtained for some elements M within format F, it is not necessary to perform a judgment on those elements M. For example, if an element M within format F has not been accessed more than a predetermined number of times (e.g., 1000 times) due to the creation of a new file, it may be flagged as "learning" and passed to the lower-level elements M without determining suitability. Since taking statistics with insufficient information may prevent the creation of an appropriate format F, it is desirable not to determine suitability for an element M if it has not been accessed more than a predetermined number of times. In this way, even if some elements M in format F are labeled "learning," if keys and acceptance criteria VF have been created in other formats F, it is possible to sufficiently determine whether the access request information A is an attack or not. Note that if there has been sufficient access to the "learning" element M, only that element M in format F may be updated, or a new format F may be created from scratch.

[0065] In the above description, an example was given in which the format creation unit 12 sets the tolerance criteria VF including formal attributes that have appeared at least once in the past. However, this embodiment is not limited to this example. For example, the format creation unit 12 may set the tolerance criteria based on formal attributes that appear with a predetermined probability or higher (0.001%). Alternatively, the tolerance criteria may be set based on formal attributes of values ​​that are accessed from multiple (three or more) access sources. For example, the format creation unit 12 basically sets the tolerance criteria VF including formal attributes that have appeared at least once in the past, and if the tolerance criteria VF needs to be made stricter, the tolerance criteria VF may be set using the occurrence rate or the number of accesses as thresholds.

[0066] In the above description, an example was given in which the information processing device 10 stores the access request information A either as is or broken down into individual values ​​in order to create format F. When storing the information broken down into individual values, it is not necessary to store the values ​​with the any key. All values ​​with the any key are integrated into the any key, and it is not necessary to measure the frequency of occurrence of individual values ​​as with the rest key or all key, so they do not need to be stored. Also, in the case of "character class type," it is sufficient to retain information indicating the character types that have appeared in the past, and therefore the string of past values ​​themselves is not required to set the tolerance judgment criterion VF, so past values ​​of the any key do not need to be stored. This reduces the capacity required to store the values ​​that are integrated into the any key. However, in the case of the rest key and all key, in order to create the specified key and the integrated key, it is preferable to measure the frequency of occurrence of values ​​and continue to store the values ​​that have appeared in the past.

[0067] As described above, the conditions for setting the `all` key are less stringent compared to other integration keys, but the actual judgment is not easily relaxed. For example, if elements that take almost only unique values, such as subdomains, are integrated into the `all` key, the acceptance criterion VF for the `all` key will be almost the same as that for the specified key. Also, if the `all` key is set for an element M that is a machine-generated value, the acceptance criterion VF will be the same as that for the `any` key. Therefore, even if an integration key with relatively lenient conditions like the `all` key is established, it is difficult to relax the conditions as in the conventional whitelist type, and attacks can be appropriately detected. Consequently, the information processing device 10 can detect unknown attacks.

[0068] As explained above, it is possible for one information processing device 10 to be connected to multiple successor servers 30. However, from the perspective of the information processing device 10 creating a format for access request information to the successor servers 30 and determining whether or not it is an attack, it is more desirable for only one successor server 30 to be connected to the information processing device 10. This makes it possible to create a format F that is specialized for access request information to the successor servers 30, thereby improving the accuracy of the determination.

[0069] In the above description, an example was given in which the information processing device 10 and the successor server 30 are configured separately. However, this embodiment is not limited to this example, and the information processing device 10 may be configured within the successor server 30. For example, the functions of the information processing device 10 may be realized by the successor server 30.

[0070] [Summary of Embodiments] According to the embodiment described above, the information processing device 10 includes an acquisition unit 11 that acquires access request information A including a plurality of elements M, an integration process that sets one or more analysis targets for each element M value by setting one or more analysis targets for each element M value according to at least one of the values ​​of each element M, the frequency of occurrence of the values, and the number of types of values, for each analysis target, an analysis process that analyzes the formal attributes of the values ​​included in the analysis target for each analysis target, and a setting process that sets an acceptable judgment criterion VF for element M based on the analyzed formal attributes, thereby creating a format F for the access request information A. In the case of conventional whitelist-type intrusion detection, it is necessary to update the configuration file each time the subsequent server 30 is updated, but the information processing device 10 can automate the configuration update by accumulating information and creating format F when access violating the specified format comes from multiple IP addresses during the waiting time. In other words, updates to the subsequent server 30 can be automatically handled by extending format F.

[0071] Furthermore, conventional whitelist-type detection employs a loose check that allows most values ​​to pass, essentially a blacklist-type approach that defines only those values ​​that cannot pass, resulting in extremely low effectiveness in detecting attacks and malicious activity. Additionally, raising the check criteria to improve detection accuracy can lead to problems such as the inability to handle dynamically added content, including the addition of new paths, and the need for individual settings for fluctuating values. Therefore, conventional whitelist-type detection suffers from numerous false positives and is difficult to use except in situations where access methods are strictly limited, such as via APIs (Application Programming Interfaces). Moreover, conventional whitelist and blacklist-type detection relies on manual or partially automated creation of pattern files, failing to achieve complete automatic generation. This makes it difficult to address patterns unknown to administrators. In contrast, the information processing device 10 utilizes three integrated keys—any, rest, and all—to fully automatically create detection formats without prior knowledge of attacks. Furthermore, the information processing device 10 can extend its detection format to accommodate content where values ​​change dynamically, such as CGM (Consumer Generated Media). Therefore, according to the information processing device 10 of this embodiment, it is possible to detect unknown attacks and respond to zero-day attacks. While older computers could not implement such technology due to the excessive computational load and data capacity, the increased performance of modern computers has made the approach described in this embodiment possible.

[0072] Furthermore, according to the embodiment described above, the format creation unit 12 sets the target for analysis by assigning a key to each value, which is determined according to at least one of several types of keys, the value's frequency of occurrence, and the number of value types. That is, there are several types of integrated keys, such as any key, rest key, and all key, which are assigned to set multiple types of values ​​as the target for analysis, and which integrated key to set is determined by the trend of the values ​​that appear. When determining whether or not a value conforms to format F, the integrated key acts as a so-called wildcard. Usually, one type of wildcard is sufficient for any value; for example, the wildcard that represents "any zero or more characters" is "* (asterisk)". In contrast, the format creation unit 12 according to the embodiment sets multiple types of wildcards. By providing multiple types of wildcards, it is possible to create wildcards appropriately in accordance with the characteristics of the values ​​generated by the operation of the program. As a result, the information processing device 10 can create a high-quality format F even in a fully automated state.

[0073] Furthermore, according to the embodiment described above, the format creation unit 12 sets all values ​​of element M as a single analysis target by assigning the "any" key to them when the overlap rate based on the number of value types and the number of access request information A is below a predetermined level, and sets the acceptable judgment criterion VF for the "any" key based on the formal attributes of the values ​​assigned the "any" key. In this case, the "any" key may also be called the first key. In the case of values ​​with very high randomness, such as machine-generated values, even if the value itself is included in format F, the probability of a match is very low. Therefore, the mismatch cannot be used to determine whether the access is normal or not, and it is not suitable for format F. Also, manually creating a format for such machine-generated values ​​is very time-consuming. According to the information processing device 10 of the embodiment, it is possible to appropriately analyze the formal attributes of machine-generated values ​​and automatically create a format F that can handle highly random values ​​such as machine-generated values ​​of unknown access request information A.

[0074] Furthermore, according to the embodiment described above, if the number of value types exceeds a predetermined value, the format creation unit 12 assigns a rest key to values ​​among the values ​​of element M whose values ​​based on frequency of occurrence are less than or equal to a predetermined value, thereby setting them as a single analysis target, and sets the rest key acceptance criterion VF based on the formal attributes of the values ​​to which the rest key is assigned. At this time, the threshold for the number of value types and the threshold for the values ​​based on frequency of occurrence may be different values ​​from each other. The rest key may also be called a second key. That is, the format creation unit 12 keeps some values ​​that receive a lot of access, such as site names, as specified keys, while integrating other values ​​that receive less access into the rest key. This makes it possible to create a format F that can appropriately determine whether or not there is an attack on unknown access request information A by grasping the values ​​that receive a lot of access (the main ones) and detecting attacks, while grasping the formal attributes of values ​​that do not receive a lot of access and responding flexibly.

[0075] Furthermore, according to the embodiment described above, the format creation unit 12 assigns an "all key" to values ​​of element M whose values ​​based on frequency of occurrence are above a predetermined level, thereby setting them as a single analysis target. Based on the formal attributes of the values ​​with the "all key" assigned, it sets an acceptable judgment criterion VF for the "all key," and sets the values ​​with the "all key" assigned to them as the acceptable judgment criterion VF for the values. In this case, the "all key" may be referred to as a third key. For example, when setting an "all key," the format creation unit 12 may duplicate each of the values ​​to be set, using one copy for analyzing the formal attributes of the "all key" and the other copy for analyzing the formal attributes of each value. This allows the format creation unit 12 to grasp the main components of element M and respond to patterns that appear rarely, while also including the main component values ​​themselves in the format F. In addition, since the format creation unit 12 analyzes the formal attributes of the main component values ​​as formal attributes of the "all key," it can suppress a decrease in the difficulty of passing the "all key." Therefore, according to the information processing device 10 of the embodiment, it is possible to create a format F that is flexible and capable of responding to unknown attacks.

[0076] Furthermore, according to the embodiment described above, the information processing device 10 further includes a determination unit 13 that determines that access to the server by access request information A is normal if the access request information A to the server (successor server 30) conforms to the formal attributes of each element M included in the format F created by the format creation unit 12. The information processing device 10 further includes the determination unit 13, which can appropriately determine unauthorized access and access for attack purposes and block such access. In addition, since the determination criteria are automatically updated when the format F is updated, it can easily handle updates and content whose values ​​change dynamically.

[0077] [Example Hardware Configuration] Figure 7 is a schematic diagram of an example hardware configuration of an information processing device 90 applied to an embodiment. The information processing device 90 comprises a processor 91, main memory 92, communication interface 93, auxiliary storage device 94, input / output interface 95, and internal bus 96. The processor 91, main memory 92, communication interface 93, auxiliary storage device 94, and input / output interface 95 are connected to each other via the internal bus 96 so as to be able to communicate with each other. The information processing device 90 may be applied to, for example, an information processing device 10 or a subsequent server 30. In this case, for example, the acquisition unit 11 and the output unit 14 may be configured using the communication interface 93 and the input / output interface 95. For example, the storage unit (not shown) may be configured using the auxiliary storage device 94. Also, the format creation unit 12 and the determination unit 13 may be configured using the processor 91 and the main memory 92.

[0078] The information processing device 10 may be implemented using multiple information processing devices. For example, the information processing device 10 may be implemented using a device such as a cloud. For example, in the information processing device 10, the storage unit 22 and the control unit 23 may be implemented in different information processing devices. For example, the storage unit 22 of the information processing device 10 may be distributed and implemented in multiple information processing devices. Furthermore, the entirety or part of the functions of each part of the information processing device 10 in the above-described embodiment may be realized by recording a program for realizing these functions on a computer-readable recording medium, having a computer system read the program recorded on this recording medium, and executing it. Here, "computer system" includes hardware such as an OS and peripheral devices.

[0079] Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, magneto-optical disks, ROMs, and CD-ROMs, as well as recording units such as hard disks built into computer systems. In addition, "computer-readable recording media" may include those that dynamically hold programs for a short period of time, such as communication lines used when transmitting programs over networks such as the Internet or communication lines such as telephone lines, and those that hold programs for a certain period of time, such as volatile memory inside computer systems that act as servers or clients in such cases. Moreover, the above-mentioned program may be for the purpose of realizing some of the functions described above, and may also be able to realize the above-mentioned functions in combination with programs already recorded in the computer system.

[0080] Although one embodiment of this invention has been described in detail above with reference to the drawings, the specific configuration is not limited to that described above, and various design changes can be made without departing from the spirit of this invention. Furthermore, the configurations described in each embodiment and example above may be combined. [Explanation of Symbols]

[0081] 1... Information processing system, 10... Information processing device, 20... Terminal, 30... Successor server, 11... Acquisition unit, 12... Format creation unit, 13... Judgment unit, 14... Output unit, A... Access request information, M... Element, ... Acceptable judgment criteria, F... Format

Claims

1. An acquisition unit that acquires access request information containing multiple elements, For each of the multiple access request pieces of information, An integrated process that sets one or more of the aforementioned values ​​as the target of analysis for each of the aforementioned values, by treating each of the aforementioned values, the frequency of occurrence of the aforementioned values, and the number of types of the aforementioned values ​​as the target of analysis, For each of the aforementioned objects of analysis, an analysis process is performed to analyze the formal attributes of the values ​​included in the object of analysis, A setting process that sets the tolerance criteria for the element based on the analyzed formal attributes, A format creation unit creates the format of the access request information by performing the following: An information processing device equipped with the following features.

2. The format creation unit sets the target of analysis by assigning to multiple types of values ​​a key of at least one of the multiple types of keys, the key which is determined according to at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of values. The information processing apparatus according to claim 1.

3. The aforementioned format creation unit, If the overlap rate based on the number of types of the aforementioned values ​​and the number of access request information is less than or equal to a predetermined value, all of the values ​​of the aforementioned elements are assigned a first key and set as one of the aforementioned analysis targets. Based on the formal attributes of the value to which the first key is assigned, the acceptance criteria for the first key are set. The information processing apparatus according to claim 1 or claim 2.

4. The aforementioned format creation unit, If the number of types of the aforementioned values ​​is greater than or equal to a predetermined value, a second key is assigned to the aforementioned values ​​of the elements whose values ​​based on their frequency of occurrence are less than or equal to a predetermined value, thereby setting them as one of the analysis targets. Based on the formal attributes of the value to which the second key is assigned, the acceptance criteria for the second key are set. The information processing apparatus according to claim 1 or claim 2.

5. The aforementioned format creation unit, A third key is assigned to the value among the aforementioned values ​​of the aforementioned elements whose value based on the frequency of occurrence is above a predetermined value, thereby setting it as one of the aforementioned analysis targets. Based on the formal attributes of the value to which the third key is attached, the tolerance criteria for the third key are set, and the value to which the third key is attached is set as the tolerance criteria for the value. The information processing apparatus according to claim 1 or claim 2.

6. A determination unit determines that access to the server by the access request information is normal if the access request information to the server conforms to the acceptance criteria for each element included in the format created by the format creation unit. The information processing apparatus according to claim 1 or claim 2, further comprising:

7. On the computer, A retrieval step to obtain access request information containing multiple elements, For each of the multiple access request pieces of information, An integrated process that sets one or more of the aforementioned values ​​as the target of analysis for each of the aforementioned values, by treating each of the aforementioned values, the frequency of occurrence of the aforementioned values, and the number of types of the aforementioned values ​​as the target of analysis, For each of the aforementioned objects of analysis, an analysis process is performed to analyze the formal attributes of the values ​​included in the object of analysis, A setting process that sets the tolerance criteria for the element based on the analyzed formal attributes, By performing the above, a format creation step is performed to create the format of the access request information, A program that executes the command.

8. A retrieval step to obtain access request information containing multiple elements, For each of the multiple access request pieces of information, An integrated process that sets one or more of the aforementioned values ​​as the target of analysis for each of the aforementioned values, by treating each of the aforementioned values, the frequency of occurrence of the aforementioned values, and the number of types of the aforementioned values ​​as the target of analysis, For each of the aforementioned objects of analysis, an analysis process is performed to analyze the formal attributes of the values ​​included in the object of analysis, A setting process that sets the tolerance criteria for the element based on the analyzed formal attributes, By performing the above, a format creation step is performed to create the format of the access request information, Information processing methods including

Images