Attack detection device, attack detection method, and attack detection program

Abstract

To enable accurately detecting in early stages various attacks made on a network.SOLUTION: An apparatus for detecting attacks 1 comprises an aggregating section 11 that receives subject-of-analysis data for analyzing an attack carried out on a network, aggregates the number of observations based on each of predetermined items and records the aggregated number of observations as time series data, a change-point detecting section 121 that calculates a change-point score by performing a time series analysis on the time series data over a predetermined period of time and detects, based thereon, a change point in time series tendency of the time series data, and an aggregate-value tendency determining section 122 that, if the change point is detected, determines whether there is an increasing tendency in time series tendency at a predetermined time immediately before the detection point of time and, if determines there is an increasing tendency, determines that an attack on the network is detected at a detection point of time of the change point, thereby outputting a fact thereof.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an apparatus, a method, and a program for detecting attacks on a network. [Background technology]

[0002] Activities such as DoS attacks, which target specific servers on a network and send a large amount of traffic to attack and disrupt their operation, have become a problem. Technologies for early detection of attacks on a network are disclosed in, for example, Non-Patent Document 1 and Non-Patent Document 2. Non-Patent Document 1 proposes ChangeFinder, a method for detecting change points, which are time points at which time series trends change in time series data. ChangeFinder calculates a change point score to quantitatively grasp the change in time series trends at a certain point in time series data. The change point score value is calculated using, for example, two-stage learning and a sequentially discounting auto-regressive learning (SDAR) algorithm. Non-Patent Document 2 proposes a method for detecting new vulnerability search activities (scans) based on changes in time series trends in information about traffic received by honeypots installed at multiple locations. Specifically, log information is periodically collected from multiple honeypots and registered in a database. The log information includes information such as communication protocol, source IP address, destination port number, number of accesses, and number of packets received per unit time. Based on the registered log information, the communication protocol, number of accesses to the destination port number, and maximum number of packets received per unit time are tallied for each honeypot to create time series data. Changes in the time series trends of the data are detected as change points, for example, by ChangeFinder. The detected change points can be estimated to be possible new attacks or changes in attack trends. It is said that new scans can be detected based on the number of packets received per unit time, which makes it possible to discover new DDoS attacks launched by attackers early and take measures against them. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Kenji Yamanishi, Jun-ichi Takeuchi, “A Unifying Framework for Detecting Outliers and Change Points from Non-stationary Time Series Data”, IEEE Transactions on Knowledge and Data Engineering, Vol. 18, No. 4, pp. 482-492, 2006 [Non-Patent Document 2] Sho Yamamura, Mitsutoshi Kumagai, Kazunori Kamiya, Hiroshi Kurakami, "A study on early detection method of new scans using change point detection," Proceedings of Computer Security Symposium 2017, October 2017, pp.823-830 Summary of the Invention [Problem to be solved by the invention]

[0004] However, Non-Patent Document 2 has a problem in that it is specialized in detecting the occurrence of scans that are considered to be a sign of DoS attacks, and does not predict the occurrence of new attacks in other attacks such as those targeting vulnerabilities in servers on a network. In addition, when a method for detecting change points in time-series trends such as ChangeFinder proposed in Non-Patent Document 1 is simply applied to predict the occurrence of an attack, the calculated change point score value increases even when the attack packets decrease suddenly, so there is a problem in that it is difficult to accurately detect only a sudden increase in attack packets that is thought to have a strong causal relationship with the occurrence of an attack from only the increase or decrease in the score.

[0005] An object of the present invention is to provide an attack detection device, an attack detection method, and an attack detection program that enable early and accurate detection of various attacks carried out on a network. [Means for solving the problem]

[0006] An attack detection device according to one embodiment of the present invention includes an aggregation unit configured to receive analysis target data for analyzing attacks carried out on a network, aggregate the number of observations for the analysis target data for each specified aggregation item, and record the aggregated number of observations as time series data; a change point detection unit configured to perform a time series analysis of the time series data for each specified aggregation item over a specified period to calculate a change point score, and to detect a change point in a time series trend of the time series data based on the calculated change point score; and an aggregate value trend determination unit configured, when the change point is detected, to determine whether there is an upward trend in the time series trend at a specified time immediately prior to the change point detection time, and if it is determined that there is an upward trend, to determine that an attack on the network has been detected at the change point detection time and to output such fact.

[0007] The aggregate value trend determination unit may perform a linear regression process to a linear function based on the time series data for the aggregate item at a predetermined time immediately before the change point detection time, and when it determines that the slope of the obtained regression line is greater than a predetermined threshold, it may determine that the time series trend of the time series data has an increasing trend.

[0008] The aggregate value trend determination unit may further determine whether there is an upward trend in the time series trend of the time series data related to at least one aggregation item other than the aggregation item related to the time series data for which it has been determined that there is an upward trend in the time series trend, and if it determines that there is an upward trend, it may determine that an attack on the network was detected at the time the change point was detected and output such fact.

[0009] If the aggregate value trend determination unit determines that all aggregate values ​​for the aggregate items at a specified time immediately before the change point detection point are greater than a specified threshold, it may determine that the time series trend of the time series data is increasing.

[0010] When the aggregate value trend determination unit determines that the maximum aggregate value of a latter half period in a specified time immediately before the change point detection time is greater than the maximum aggregate value of a first half period in a specified time immediately before the change point detection time, it may determine that the time series trend of the time series data has an increasing trend.

[0011] When the aggregate value trend determination unit determines that there is a predetermined threshold or more of a point in time at which the aggregate value at the predetermined time immediately before the change point detection point is equal to or greater than a predetermined percentage of the maximum aggregate value, the aggregate value trend determination unit may determine that there is an increasing trend in the time series data.

[0012] If the aggregate value trend determination unit determines that the maximum aggregate value during a specified time period immediately before the change point detection time is equal to or greater than a specified threshold, it may determine that the time series trend of the time series data is on the rise.

[0013] In another aspect of the attack detection method of the present invention, an information processing device receives analysis target data for analyzing attacks carried out on a network, calculates the number of observations for each specified aggregation item for the analysis target data, and records the calculated number of observations as time series data, performs a time series analysis of the time series data for each specified aggregation item over a specified period to calculate a change point score, and detects a change point in the time series trend of the time series data based on the calculated change point score, and, when the change point is detected, determines whether there is an upward trend in the time series trend at a specified time immediately prior to the change point detection time, and if it is determined that there is an upward trend, determines that an attack on the network has been detected at the time of the change point detection and outputs such a fact.

[0014] An attack detection program according to another aspect of the present invention is for causing a computer to function as the attack detection device. Effect of the Invention

[0015] According to the present invention, it is possible to detect various attacks carried out on a network early and with high accuracy. [Brief description of the drawings]

[0016] [Figure 1] 2 is a diagram illustrating an example of a functional configuration of an attack detection device according to an embodiment of the present invention; [Diagram 2] 11 is a diagram illustrating an example of input data provided to a counting unit included in the attack detection device according to an embodiment. [Diagram 3] FIG. 11 is a diagram illustrating an example of tabulated data generated by a tabulating unit according to an embodiment. [Figure 4] 10A and 10B are diagrams illustrating an example of a process for detecting a change point in a time series trend by an attack detection device according to an embodiment; [Diagram 5] 11 is a diagram for explaining an example of a process for detecting an increase trend in a count value by an attack detection device according to an embodiment; [Figure 6]10 is a flowchart illustrating a processing procedure for attack detection by an attack detection device according to an embodiment. [Figure 7] FIG. 13 is a diagram showing an example of an output display of attack detection information. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, the present invention will be described based on an embodiment with reference to the accompanying drawings. The attack detection device in this embodiment imports monitoring logs and the like output by monitoring devices on other networks (e.g., Intrusion Detection Systems (IDS)) as data to be analyzed for attack detection, and generates time-series data by aggregating the data in a time series according to specified aggregation items. The attack detection device then analyzes the time-series trends of the time-series data, and if it determines that the time-series trend has changed and that the aggregate value for the aggregation item in which a change in the time-series trend was detected has increased over a fixed period of time, it determines that an attack or a sign of an attack has been detected, and outputs that fact. The attack detection device may be provided with the configuration of a monitoring device such as an IDS, and traffic data on the network may be directly input to the attack detection device.

[0018] FIG. 1 is a diagram illustrating an example of a functional configuration of an attack detection device 1 according to the present embodiment. The attack detection device 1 is an information processing device (computer) such as a server or a personal computer, and includes a control unit 10, a storage unit 20, as well as various data input / output devices and communication devices.

[0019] The control unit 10 is a part that controls the entire attack detection device 1, and realizes each function of the attack detection device 1 in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a processor such as a CPU.

[0020] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the attack detection device 1, and may be a ROM, a RAM, a flash memory, or a hard disk (HDD), etc. Specifically, the storage unit 20 stores a program (attack detection program) for causing the control unit 10 to execute each function of this embodiment, various parameters, input data input from an external monitoring device, etc., time-series data created by a counting unit described later, counted data for each counting item, etc.

[0021] The control unit 10 includes a counting unit 11 and a detection unit 12. The detection unit 12 includes a change point detection unit 121 and a count value trend determination unit 122. The control unit 10 generates time-series data for each aggregation item over a predetermined period based on the analysis target data imported from the network using these functional units, and detects whether a change has occurred in the time-series trend of the time-series data. If it is determined that a change has occurred in the time-series trend, it determines whether there is an increasing trend in the number of aggregations per unit time for the most recent fixed time period for the corresponding aggregation item, and if it is determined that there is an increasing trend, it determines that an attack or a sign of an attack has been detected and outputs attack detection information.

[0022] In this embodiment, the analysis target data that the attack detection device 1 imports from the network is, for example, log data acquired from other monitoring devices on the network. Fig. 2 shows an example of the configuration of input data 21 to the attack detection device 1 in this embodiment. In the example of Fig. 2, the log data imported into the attack detection device 1 includes information such as the detection date and time of the data, a signature indicating the detection name, the type of attack related to the detection, a source IP address, and a destination IP address. Note that the types of information included in the input data 21 in Fig. 2 are merely examples, and other information may be included in addition to or in place of this information.

[0023] The aggregation unit 11 sequentially acquires the log data, and generates input data 21, which is time-series data arranged in chronological order according to the acquisition order, as shown in Fig. 2. The generated input data 21 is stored in the storage unit 20.

[0024] The aggregation unit 11 aggregates the number of observations of the data to be analyzed per unit time for each pre-specified aggregation item in time series based on the input data 21 stored in the memory unit 20, to generate aggregated data 22, which is time-series data. The items to be counted in this case include information items included in the input data 21, such as the signature and attack type. Two or more items of the information items in the input data 21 may be combined to define a new item to be counted, and data may be counted for each new item. Fig. 3 shows an example of the configuration of the counted data 22. In the example of Fig. 3, a combination of signature and attack type is used as the count item, and the number of observations of the corresponding count item is counted for each time period. The counted data 22 is time-series data on the number of observations for each time period and for each count item.

[0025] The detection unit 12 includes a change-point detection unit 121 and an aggregated value trend determination unit 122. The change-point detection unit 121 performs a change-point detection process using ChangeFinder on aggregated data 22 illustrated in Fig. 3, and analyzes whether a significant change has occurred in the number of observations of data for a specific aggregated item over a given period of time in the past, as an attack on the network or a sign of an attack. Change-point detection using ChangeFinder is described in, for example, Non-Patent Document 1 mentioned above. Specifically, in the first stage of learning, the change point detection unit 121 performs the time series data X t Based on an autoregressive (AR) model, a probability density function is obtained by learning using the SDAR algorithm, which is an online forgetting type learning algorithm, for each time t from the aggregated data 22 for a predetermined period as . tThe outlier score of each of the data included in a certain time T is calculated as Shannon information. Next, the average of the outlier scores of the data included in the certain time T is calculated, and a time series of moving average scores is constructed by time T. Furthermore, as a second stage of learning, an AR model is applied to the time series of moving average scores to obtain a learned time series, and the Shannon information at each time t is calculated as a change-point score at time t. In ChangeFinder, the above learning process can be performed online, and the larger the change-point score, the higher the likelihood that the time t is a change point. In the change-point detection unit 121, when the calculated change-point score is greater than a predetermined threshold value, the corresponding time is determined to be a change point. The change-point detection process using ChangeFinder has the advantage that it can calculate change-point scores in real time through online learning, and that the amount of calculations in the learning process can be reduced by using the SDAR model. However, this does not prevent the use of other methods for change-point detection.

[0026] FIG. 4 shows a schematic diagram of the change point detection process. The change point score continuously calculated by ChangeFinder is compared with a predetermined threshold, and the time t at which the change point score value exceeds the threshold is determined to be a change point that occurred in the time series of the aggregated data. The threshold of the change point score can be set to, for example, an upper limit of a 100(1-α)% confidence interval (e.g., a 95% confidence interval) calculated based on the change point score in a predetermined period (e.g., the past 14 days), but is not limited to this. In this embodiment, the change point score is calculated based on the time series data of the past 14 days (T1=14 days), but the period of the target time series data can be adjusted as appropriate.

[0027] The aggregated value trend determination unit 122 examines the increasing trend of the aggregated data over a predetermined past time period from the time t determined to be a change point by the above processing. Specifically, for example, the time-series data in the past 12 hours from the time t determined to be a change point is linearly regressed, and it can be determined whether the number of aggregated data is in an increasing trend in the most recent past based on the slope of the obtained straight line. For example, when the aggregated value trend determination unit 122 determines that the slope of the regression straight line is positive, it can be determined that the time-series trend of the aggregated data is in an increasing trend. FIG. 5 schematically shows the time-series trend determination process of the aggregated value by the aggregated value trend determination unit 122. A regression straight line is obtained for the time-series data from the time t determined to be a change point to 12 hours before T2, that is, the 12 hours immediately before the change point detection time. When the slope is positive, it is determined that the time-series trend of the aggregated value is in an increasing trend.

[0028] In addition, in the aggregated value trend determination unit 122, as a weighting condition for determining whether the time-series trend of the aggregated value is in an increasing trend, a condition that all the aggregated values at the time T2 are greater than a predetermined threshold value may be set. In this case, the predetermined threshold value can be set to μ - 2σ, for example, when the average of the aggregated values in the predetermined period before the change point is μ and the standard deviation is σ. Also, as a similar weighting condition, a condition that the maximum value of the aggregated values in the second half period (t’ - T / 2 ≤ t < t’) is greater than the maximum value of the aggregated values in the first half period (t’ - T ≤ t < t’ - T / 2) of a predetermined period T may be set. Here, t’ is the unit time of the inspection target. By doing so, it is possible to reduce the risk of erroneously determining that the result of the linear regression regarding the aggregated data 22 in a predetermined period is not in an increasing trend due to the influence of outliers included in the aggregated value.

[0029] Also, in order to prevent overdetection of an increasing trend due to a sudden increase in the count value for a certain count item caused by a network malfunction or the like, or a change in the count value from 0 for a certain period of time to a value other than 0 being detected as a change point, it may be specified that there are a predetermined threshold or more points in a certain period where the count value is a predetermined percentage or more of the maximum count value for that period. Alternatively, it may be specified that the maximum count value for a certain period of time is equal to or greater than a predetermined threshold.

[0030] In addition, when it is determined that the time series trend of the aggregated values ​​has an increasing trend, in order to exclude cases where the increasing trend is due to events other than the occurrence of attacks on the network, such as a sudden increase in access by general users to the destination system or a system failure, that is, to exclude events that are considered to be overdetection of the occurrence of attacks, the aggregated value trend determination unit 122 may execute a change point detection process and an aggregated value increasing trend determination process for aggregated data that takes into account other aggregation items than the above aggregation items. For example, when "destination system name" is used as the first aggregation item, and an increasing trend is detected in the time series trend of the time series data in the aggregation data with the destination system name "system A", "signature category name" may be added and selected as another aggregation item, and a combination of the destination system name "system A" and the signature category name "category A" may be generated as a new aggregation item, and it may be determined whether there is a further increasing trend in the time series trend of the time series data related to that aggregation item. In this case, if the time series trend has changed and is determined to be increasing, and the item value of the new aggregation item that is the basis of the determination satisfies a predetermined condition, it can be determined that an attack has occurred in that time period. The predetermined condition may be, for example, when either or both of the following two conditions are met: the number of item values ​​of the additional aggregation item that is the basis of the determination is equal to or less than a predetermined threshold, or the item values ​​of the additional aggregation item that is the basis of the determination do not include any item value that has been designated in advance as an exclusion candidate.

[0031] If the aggregate value trend determination unit 122 determines that the time series trend of the aggregate value is on the rise, it determines that an attack related to the aggregate item in question, such as an SQL injection, has occurred on the network, since the aggregate data for the relevant aggregate item has increased immediately before the change point, and outputs a message to that effect.

[0032] Next, the overall operation of the attack detection device 1 according to this embodiment having the above-described configuration will be described with reference to Fig. 6. Fig. 6 is a flowchart illustrating the overall operation of the attack detection device 1. The attack detection device 1 executes the data processing illustrated in Fig. 6 at a predetermined time interval (for example, every hour). Alternatively, the attack detection device 1 may execute the data processing illustrated in Fig. 6 in response to receiving data to be analyzed.

[0033] When the attack detection device 1 starts processing, in step S10, the aggregation unit 11 acquires data to be analyzed, here log data of a monitoring device on the network. Next, in step S20, the aggregation unit 11 aggregates the acquired data to be analyzed for each predetermined aggregation item, and generates aggregated data as time-series data.

[0034] In step S30, the change-point detection unit 121 of the detection unit 12 calculates a change-point score by the ChangeFinder method based on the time-series data of the aggregated data for a predetermined past period. In step S40, the change point detection unit 121 determines whether a change point has been detected based on the calculated change point score. If it is determined that a change point has not been detected (if NO), the process returns to the processing by the counting unit 11 in step S10. If it is determined that a change point has been detected (if YES), the process proceeds to step S50 by the count value tendency determination unit 122. In step S50, the aggregate value trend determination unit 122 analyzes the time-series trend of the aggregate data for the past 12 hours from the time t of the detected change point. In step S60, the aggregated value trend determination unit 122 determines whether the time series trend is an increasing trend, and if it is determined that the time series trend is not an increasing trend (if NO), the process returns to step S10 of the aggregation unit 11. If it is determined that the time series trend is an increasing trend (if YES), in step S70, the aggregated value trend determination unit 122 determines that some kind of attack has occurred on the network, outputs a message to that effect, and ends the process. The output destination of the attack occurrence information can be, for example, an output device such as a monitor display provided in the attack detection device 1, but there is no particular restriction and it may be determined appropriately.

[0035] In the data processing exemplified in Fig. 6, the presence or absence of a change point in the time series data for one tally item and the presence or absence of an increasing trend in the time series trend are determined, but when it is determined that there is an increasing trend for one tally item, it may be further determined whether there is a similar increasing trend for the time series data for other tally items. In this case, in the flowchart exemplified in Fig. 6, when it is determined that there is an increasing trend in step S60 (YES in step S60), the tally value tendency determination unit 122 selects another tally item different from the tally item for which an increasing trend has already been determined, and executes the process of step S40. In this way, when the other aggregation items are used to determine the increasing trend, multiple other aggregation items may be used. For example, if the first aggregation item is "destination system", additional aggregation items such as "signature category name" and "source network" may be used for analysis. Furthermore, when the increasing trend is determined using other aggregation items, the process from step S40 may be additionally executed using still other aggregation items. For example, when "destination system" is used as the first aggregation item and "signature category name" is used as another aggregation item, "source network" can be selected as another aggregation item to further execute the increasing trend determination. This specifically means that the increasing trend is determined based on the time series trends of the three aggregation items, "destination system" being "system A", "signature category name" being "category A", and "source network" being "network A". By performing this type of processing, the increase trend can be determined using aggregated data that takes into account other aggregation items in addition to the one aggregation item for which an increasing trend has been detected over time, thereby suppressing detection of causes other than attacks and more accurately detecting events that are suspected to be the result of an attack. In addition, the item values ​​of the aggregation items used to determine whether there is an increasing trend in the time series of the aggregated values ​​may be determined according to an appropriate policy, such as selecting from item values ​​that are considered to be highly correlated with the occurrence of attacks based on past trends in attack detection.

[0036] As described above, the attack detection device 1 according to this embodiment can detect various attacks occurring on a network early and with high accuracy.

[0037] FIG. 7 shows an example of the output of attack detection information regarding attacks detected by the tally value trend determination unit 122. In the example of FIG. 7, the tally value trend determination unit 122 detects a change point in the time series trend of the tally data 22 for the signature and attack type, which are the tally items, and further determines that the time series trend immediately before the change point is on the rise. In this example, a display screen example is shown in which a Web page is generated including items of the detection time, signature and attack type, the increase rate of the number of tally items, and the attack probability, and is displayed on an appropriate output terminal via the Internet. The number increase rate is information calculated and output from the slope of a regression line based on time series data, etc., in order to quantitatively present the degree of the increase trend for the tally items determined to be on the rise. In addition, the attack probability is presented as a reference value of the degree of accuracy that can be expected for the current judgment based on past cases in which attacks were determined to have occurred for the output tally items. The attack detection information is not limited to the items exemplified in FIG. 7, and may include other items. The display screen of FIG. 7 may be displayed on an output device such as a monitor display of the attack detection device 1.

[0038] As described above, the attack detection device 1 according to this embodiment makes it possible to detect the occurrence of a new attack on a network at an early stage. In analyzing the time series trend of the aggregated data as time series data, the judgment condition is whether or not the observed event (aggregated value) is on the increase in addition to the deviation from the time series trend, so that it is possible to effectively detect events that have a strong causal relationship with the occurrence of an attack.

[0039] The aggregate value trend determination unit performs linear regression processing to a linear function based on the time series data for the aggregate item at a specified time immediately before the change point detection time, and when it determines that the slope of the obtained regression line is greater than a specified threshold, it can determine that the time series trend of the time series data has an upward trend. In this way, it is possible to quantitatively determine whether the time series data shows an increasing trend.

[0040] The aggregate value trend determination unit can be configured to further determine whether there is an increasing trend in the time series trend of the time series data related to at least one other aggregation item other than the aggregation item related to the time series data for which it has been determined that there is an increasing trend in the time series trend, and if it determines that there is an increasing trend, to determine that an attack on the network was detected at the time the change point was detected and to output that fact. In this way, by determining the increasing trend using aggregated data that takes into account other aggregated items in addition to the one aggregated item for which an increasing trend has been detected over time, it is possible to suppress detection of causes other than attacks and more accurately detect events that are suspected to be the result of an attack.

[0041] The aggregate value trend determination unit may be configured to determine that the time series trend of the time series data has an increasing trend when it determines that all aggregate values ​​related to the aggregate items in the predetermined time immediately before the change-point detection time are greater than a predetermined threshold value. Also, the aggregate value trend determination unit may be configured to determine that the time series trend of the time series data has an increasing trend when it determines that the maximum aggregate value in a latter half period in a predetermined time immediately before the change-point detection time is greater than the maximum aggregate value in a first half period in the predetermined time immediately before the change-point detection time. In this way, it is possible to reduce the risk of erroneously determining that the results of linear regression on the aggregated values ​​for a specified period are not on an increasing trend due to the influence of outliers included in the aggregated values, etc.

[0042] The aggregate value trend determination unit may be configured to determine that the time series trend of the time series data has an increasing trend when it determines that, at a predetermined time immediately before the change-point detection time, the number of times at which the aggregate value at the predetermined time has an aggregate value equal to or greater than a predetermined percentage of the maximum aggregate value is equal to or greater than a predetermined threshold.Further, the aggregate value trend determination unit may be configured to determine that the time series trend of the time series data has an increasing trend when it determines that the maximum aggregate value at the predetermined time immediately before the change-point detection time is equal to or greater than a predetermined threshold. In this way, it is possible to prevent overdetection of an increasing trend by detecting a sudden increase in the aggregate value for a certain aggregation item due to a network malfunction, etc., or a change when the aggregate value becomes a value other than 0 after a certain period of time in which the value has remained 0.

[0043] In addition, the above-mentioned embodiment can, for example, improve the security of communications via a network, which can contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0044] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0045] The attack detection method by the attack detection device 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0046] 1. Attack detection device 10 Control section 11 Counting Department 12 Detection unit 121 Change point detection unit 122 Aggregate value trend judgment unit 20 Memory section

Claims

1. an aggregation unit configured to receive analysis target data for analyzing attacks performed on a network, aggregate the number of observations of the analysis target data for each predetermined aggregation item, and record the aggregated number of observations as time-series data; a change point detection unit configured to perform a time series analysis of the time series data for each of the aggregation items over a predetermined period to calculate a change point score, and to detect a change point in a time series trend of the time series data based on the calculated change point score; an aggregated value trend determining unit configured to, when the change-point is detected, determine whether there is an increasing trend in the time series trend at a predetermined time immediately before the change-point detection time point, and, when it is determined that there is an increasing trend, determine that an attack on the network was detected at the change-point detection time point and output a message to that effect; Equipped with an attack detection device in which the aggregate value trend determination unit further determines whether there is an increasing trend in the time series trend of the time series data related to at least one other aggregate item other than the aggregate item related to the time series data for which it has been determined that there is an increasing trend in the time series trend, and if it determines that there is an increasing trend, determines that an attack on the network was detected at the time the change point was detected and outputs such fact.

2. 2. The attack detection device of claim 1, wherein the aggregate value trend determination unit performs a linear regression process to a linear function based on the time series data for the aggregate item at a predetermined time immediately before the change point detection point, and if it determines that the slope of the obtained regression line is greater than a predetermined threshold, it determines that the time series trend of the time series data has an upward trend.

3. The attack detection device of claim 2, wherein the aggregate value trend determination unit determines that there is an upward trend in the time series data when the aggregate value trend determination unit further determines that all aggregate values ​​for the aggregate items at a specified time immediately prior to the change point detection point are greater than a specified threshold value.

4. The attack detection device of claim 2, wherein when the aggregate value trend determination unit further determines that the maximum aggregate value of a latter period in a specified time immediately before the change point detection time is greater than the maximum aggregate value of a first period in a specified time immediately before the change point detection time, it determines that the time series trend of the time series data has an increasing trend.

5. The attack detection device of claim 2, wherein the aggregate value trend determination unit further determines that there is a predetermined threshold or more of a point in time at which the aggregate value at the predetermined time immediately before the change point detection point is greater than or equal to the maximum aggregate value, and determines that there is an increasing trend in the time series trend of the time series data.

6. The attack detection device of claim 2, wherein the aggregate value trend determination unit further determines that the maximum aggregate value at a specified time immediately before the change point detection point is greater than or equal to a specified threshold value, and determines that the time series trend of the time series data has an upward trend.

7. An information processing device, receiving analysis target data for analyzing attacks carried out on a network, counting the number of observations for each predetermined count item in the analysis target data, and recording the counted number of observations as time series data; a process of calculating a change point score by performing a time series analysis on the time series data for each of the aggregation items over a predetermined period of time, and detecting a change point of a time series trend of the time series data based on the calculated change point score; a process of determining whether or not there is an increasing trend in the time series trend at a predetermined time immediately before the change-point detection time when the change-point is detected, and if it is determined that there is an increasing trend, determining that an attack on the network was detected at the change-point detection time and outputting such a result; a process of further determining whether or not there is an increasing trend in the time series trend of the time series data related to at least one other tabulation item other than the tabulation item related to the time series data for which it has been determined whether there is an increasing trend in the time series trend, and if it is determined that there is an increasing trend, determining that an attack on the network was detected at the time point of the change point detection and outputting that fact; An attack detection method that performs

8. The attack detection method described in claim 7, wherein the information processing device performs a linear regression process to a linear function based on the time series data for the aggregation item at a predetermined time immediately before the change point detection point, and if it determines that the slope of the obtained regression line is greater than a predetermined threshold, it determines that the time series trend of the time series data has an upward trend.

9. The attack detection method according to claim 8, wherein when the information processing device further determines that all aggregate values ​​for the aggregate items at a predetermined time immediately prior to the change point detection point are greater than a predetermined threshold, it determines that the time series trend of the time series data has an increasing trend.

10. The attack detection method of claim 8, wherein when the information processing device further determines that the maximum aggregate value of a latter period in a specified time immediately before the change point detection time is greater than the maximum aggregate value of a first period in a specified time immediately before the change point detection time, it determines that the time series trend of the time series data has an increasing trend.

11. In the information processing device, receiving analysis target data for analyzing attacks carried out on a network, counting the number of observations for each predetermined count item in the analysis target data, and recording the counted number of observations as time series data; a process of calculating a change point score by performing a time series analysis on the time series data for each of the aggregation items over a predetermined period of time, and detecting a change point of a time series trend of the time series data based on the calculated change point score; a process of determining whether or not there is an increasing trend in the time series trend at a predetermined time immediately before the change-point detection time when the change-point is detected, and if it is determined that there is an increasing trend, determining that an attack on the network was detected at the change-point detection time and outputting such a result; a process of further determining whether or not there is an increasing trend in the time series trend of the time series data related to at least one other tabulation item other than the tabulation item related to the time series data for which it has been determined whether there is an increasing trend in the time series trend, and if it is determined that there is an increasing trend, determining that an attack on the network was detected at the time point of the change point detection and outputting that fact; An attack detection program that runs

Images