Analytical device, analytical method, and analytical program

Abstract

To provide an analytical device for detecting an unauthorized use in a large-scale IT infrastructure service.SOLUTION: An analytical device 40 converts a log of a gateway device 20 for making servers 30 provide an IT infrastructure service into predetermined-format data on the basis of a result obtained by decoding a query character string extracted from URLs which are included in requests transmitted from terminals 10. The analytical device 40 detects an event meeting predetermined conditions on an unauthorized use of the IT infrastructure service from the converted data on the basis of a state of the request and information acquired from the servers 30.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an analysis device, an analysis method, and an analysis program. [Background technology]

[0002] Conventionally, IT infrastructure services provided via APIs (Application Programming Interfaces) are known. In addition, services provided via APIs may use an API processing method that generates a new request based on an API request sent from a terminal of a service user and requests the terminal to perform redirection using the generated request. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-33221 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the conventional technology has a problem that it may be difficult to detect fraudulent use in a large-scale IT infrastructure service. For example, it may be difficult from a quantitative point of view to collect logs for fraud detection from a large number of network devices and servers that exist in a network for providing a large-scale IT infrastructure service. [Means for solving the problem]

[0005] In order to solve the above-mentioned problems and achieve the objective, the analysis device has a conversion unit that converts a usage log, which is an application layer log, and an SSH (Secure Shell) log, which is a network layer log, obtained from a gateway device that causes a server to provide an IT infrastructure service based on the result of decrypting a query string extracted from a URL included in a request sent from a terminal, into a graph in which terminals, servers, and hosts are nodes and accesses between nodes are edges, and a detection unit that detects an event that satisfies specified conditions regarding unauthorized use of the IT infrastructure service from the graph converted by the conversion unit, and the detection unit is characterized in that it detects an event that satisfies the conditions based on the state of the request and information obtained from the server. Effect of the Invention

[0006] According to the present invention, unauthorized use in large-scale IT infrastructure services can be detected. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a service providing system. [Diagram 2] FIG. 2 is a diagram illustrating an analysis method using the analysis device. [Diagram 3] FIG. 3 is a diagram illustrating an example of the configuration of the analysis device. [Figure 4] FIG. 4 is a diagram for explaining conversion into a graph. [Diagram 5] FIG. 5 is a diagram illustrating an example of graph data. [Figure 6] FIG. 6 is a flowchart showing a process flow of the analysis device according to the first embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of a computer that executes an analysis program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an embodiment of an analysis device, an analysis method, and an analysis program according to the present application will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiment described below.

[0009] [Configuration of the first embodiment] First, the configuration of a service providing system including an analysis device will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of the service providing system.

[0010] As shown in FIG. 1, a service providing system 1 is a system for providing various services to service users via the Internet.

[0011] 1, a service user executes an API from a terminal 10 and receives a service provided by a server 30. For example, the terminal 10 is a smartphone or a personal computer.

[0012] The service providing system 1 can provide various services such as IT infrastructure services, financial services, and food and beverage services. For example, the IT infrastructure service is a service that allows users to use servers on a network. For example, the financial service is a service that allows online credit card payments. For example, the food and beverage service is a service that allows users to order products at restaurants via a network.

[0013] First, the terminal 10 transmits a request (for example, an HTTP request) according to the content of the service to be used to the Internet. The request transmitted by the terminal 10 is received by the gateway device 20.

[0014] The gateway device 20 extracts a query string from the URL included in the received request, decrypts the extracted query string, and requests the terminal 10 to execute a redirect based on the decrypted query string.

[0015] The terminal 10 executes the redirection in accordance with the request from the gateway device 20. At this time, the request generated by the redirection is transmitted to the server 30. The server 30 executes a predetermined application related to the provision of the service based on the received request.

[0016] Here, the analysis device 40 acquires a service usage log (usage log of IT infrastructure service) from the gateway device 20, and acquires an SSH (Secure Shell) log from the server 30. Then, the analysis device 40 uses the acquired logs to perform an analysis to detect unauthorized use of the service.

[0017] Fig. 2 is a diagram explaining an analysis method by the analysis device. As shown in Fig. 2, the analysis device 40 creates a DB (database) of logs acquired from the gateway device 20. For example, the analysis device 40 converts the usage log of the IT infrastructure service acquired from the gateway device 20 and the SSH log acquired from the server 30 into graph data and creates a DB.

[0018] Then, the analysis device 40 detects risks based on the DB, and notifies the detection result to the terminal 50 of the service operator.

[0019] The analysis device 40 can detect risks by correlation analysis between service usage logs and SSH logs. Here, the service usage logs are application layer logs, and the SSH logs are network layer logs. This enables the analysis device 40 to detect security risks by combining application layer information and network layer information.

[0020] 3 is a diagram showing an example of the configuration of an analysis device 40. As shown in FIG.

[0021] The communication unit 41 performs data communication with devices such as the gateway device 20 via the network. For example, the communication unit 41 is a network interface card (NIC).

[0022] The storage unit 42 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), an optical disk, etc. The storage unit 42 may be a semiconductor memory in which data can be rewritten, such as a random access memory (RAM), a flash memory, or a non-volatile static random access memory (NVSRAM).

[0023] The storage unit 42 stores an OS (Operating System) and various programs executed by the analysis device 40. The storage unit 42 stores log information 422 and detection information 423. The log information 422 is a log stored in a database, such as graph data. The detection information 423 is the detection result of unauthorized use.

[0024] The control unit 43 controls the entire analysis device 40. The control unit 43 is, for example, an electronic circuit such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a GPU (Graphics Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 43 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory.

[0025] The control unit 43 also functions as various processing units by the operation of various programs. For example, the control unit 43 includes a conversion unit 431, a detection unit 432, an addition unit 433, and a notification unit 434.

[0026] The conversion unit 431 converts the log of the gateway device 20, which causes the server 30 to provide an IT infrastructure service based on the result of interpreting an API request transmitted from the terminal 10, into data in a predetermined format.

[0027] It can be said that the gateway device 20 interprets the API request by decoding the query string extracted from the URL.

[0028] For example, the conversion unit 431 converts the service usage log acquired from the gateway device 20 and the SSH log acquired from the server 30 into a graph in which the terminal 10, the server 30, and the API are nodes and access between the nodes is an edge.

[0029] 4 is a diagram for explaining the conversion to a graph. The conversion unit 431 converts the acquired log into graph data having three types of nodes: "eu (end user)", "cd (client device)", and "API / host". The graph data obtained here can be said to include application layer information and network layer information.

[0030] "eu" corresponds to a service user who executes an API using a terminal 10. "cd" corresponds to the terminal 10. "API / host" corresponds to an API (or host) that can be executed in the service providing system 1. Also, an edge between nodes indicates that access has occurred.

[0031] Furthermore, when a node accesses another node multiple times, multiple edges are placed between the nodes as shown in FIG.

[0032] 5 is a diagram showing an example of graph data As an example, the conversion unit 431 converts the acquired log into graph data as shown in FIG.

[0033] The detection unit 432 detects, from the data converted by the conversion unit 431, an event that satisfies a predetermined condition related to unauthorized use of the IT infrastructure service.

[0034] The detection unit 432 can detect an event in which the success or failure of an API request is inconsistent with the HTTP status code. Note that the success or failure of an API request may be obtained from a service usage log, and the HTTP status code may be obtained from an SSH log.

[0035] For example, the detection unit 432 detects an event in which an API request from the terminal 10 has failed and the HTTP status code is in the 400 range (error).

[0036] Also, for example, the detection unit 432 detects an event in which the user of the API request from the terminal 10 is not set and the HTTP status code is in the 200 range (success).

[0037] The detection unit 432 can detect that the number of API requests of a predetermined pattern exceeds a predetermined value.

[0038] For example, the detection unit 432 detects that the average number of occurrences of a particular pattern of the URI of an API request per unit time (for example, 10 minutes) exceeds the average number of occurrences per unit time in the past.

[0039] Also, for example, the detection unit 432 detects an increase in a particular URI issued by a specific user.

[0040] In addition, the detection unit 432 detects that a new PATH (a route between the terminal 10 and the server 30) has been created between the terminal 10 and the server 30.

[0041] Also, for example, since the "eu" node 101 in Fig. 5 accesses multiple "cd" nodes, the detection unit 432 detects the "eu" node 101 as a risk. Also, for example, since the "API / host" node 201 in Fig. 5 is accessed from multiple "cd" nodes, the detection unit 432 detects the "API / host" node 201 as a risk.

[0042] Furthermore, the detection unit 432 also detects the "cd" nodes 301, 302, 303, and 304 as risks since there is access between the "cd" nodes 301, 302, 303, and 304 and the nodes 101 and 201 that have been detected as risks.

[0043] The detection unit 432 can detect behaviors related to the login of the terminal 10 to the server 30 that satisfy a predetermined condition.

[0044] For example, the detection unit 432 detects a failure in logging in. Also, for example, the detection unit 432 detects that an access has been made via a plurality of servers 30 after logging in (multi-stage SSH (Secure Shell)).

[0045] The adder 433 regards the event detected by the detector 432 as a risk and adds points to the associated node. The greater the points, the higher the possibility of fraudulent use.

[0046] The notification unit 434 notifies the operator of the detection result, for example, information about a node whose points added by the adding unit 433 have exceeded a certain value.

[0047] [Processing of the first embodiment] Fig. 6 is a flowchart showing a process flow of the analysis device according to the first embodiment. As shown in Fig. 6, first, the analysis device 40 converts logs acquired from the gateway device 20 etc. into graph data (step S101).

[0048] Next, the analysis device 40 detects risks from the graph data (step S102), and adds points to the nodes of the graph data according to the risks (step S103).

[0049] Then, the analysis device 40 notifies the operator of the detection result (step S104).

[0050] [Advantages of the First Embodiment] As described above, the conversion unit 431 converts the log of the gateway device 20, which causes the server 30 to provide an IT infrastructure service, into data in a predetermined format based on the result of interpreting the API request transmitted from the terminal 10. The detection unit 432 detects, from the data converted by the conversion unit 431, an event that satisfies a predetermined condition related to unauthorized use of the IT infrastructure service.

[0051] The analysis device 40 can obtain both information related to communication and information related to application usage by referring to the log of the gateway device 20. Therefore, according to this embodiment, it is possible to detect unauthorized use in a large-scale IT infrastructure service.

[0052] The conversion unit 431 converts the log into a graph in which the terminal 10, the server 30, and the API are treated as nodes, and access between the nodes is treated as an edge. This makes it possible to perform detection using an existing graph analysis method such as measuring the number of edges.

[0053] The detection unit 432 detects an event in which the success or failure of an API request is inconsistent with the HTTP status code, thereby making it possible to detect unauthorized API execution.

[0054] The detection unit 432 detects that the number of API requests of a predetermined pattern exceeds a predetermined value. The detection unit 432 also detects that a new PATH has been created between the terminal 10 and the server 30. This makes it possible to detect unusual behavior regarding API requests.

[0055] The detection unit 432 detects behavior that satisfies a predetermined condition from among behaviors related to login of the terminal 10 to the server 30. This makes it possible to detect unauthorized login.

[0056] [System configuration, etc.] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic. Note that the program may be executed not only by the CPU but also by other processors such as a GPU.

[0057] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0058] [program] In one embodiment, the analysis device 40 can be implemented by installing an analysis program that executes the above-mentioned analysis processing as package software or online software on a desired computer. For example, the above-mentioned analysis program can be executed by an information processing device, thereby making the information processing device function as the analysis device 40. The information processing device referred to here includes desktop or notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and even slate terminals such as PDA (Personal Digital Assistant), etc.

[0059] 7 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0060] The memory 1010 includes a read only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0061] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the analysis device 40 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of the analysis device 40 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0062] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0063] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0064] 1 Service provision system 10, 50 terminals 20 Gateway device 30 Servers 40 Analyzer 41 Communications Department 42 Storage section 43 Control Unit 422 Log information 423 Detection Information 431 Conversion Unit 432 Detection unit 433 Addition Section 434 Notification Department

Claims

1. a conversion unit that converts a usage log, which is an application layer log, and a Secure Shell (SSH) log, which is a network layer log, of an IT infrastructure service log obtained from a gateway device that causes a server to provide the IT infrastructure service based on a result of decoding a query string extracted from a URL included in a request transmitted from a terminal, into a graph in which terminals, servers, and hosts are nodes and accesses between the nodes are edges; a detection unit that detects an event that satisfies a predetermined condition regarding unauthorized use of the IT infrastructure service from the graph converted by the conversion unit; having The analysis device is characterized in that the detection unit detects an event that satisfies the condition based on the state of the request and information obtained from the server.

2. 2. The analysis device according to claim 1, wherein the detection unit detects whether the number of requests of a predetermined pattern exceeds a predetermined value.

3. The analysis device according to claim 1 , wherein the detection unit detects that a new PATH has been generated between the terminal and the server.

4. The analysis device according to claim 1 , wherein the detection unit detects behaviors related to logging in to a server from a terminal that satisfy a predetermined condition.

5. An analytical method performed by an analytical device, comprising: a conversion process for converting a usage log, which is an application layer log, and a Secure Shell (SSH) log, which is a network layer log, obtained from a gateway device that causes a server to provide an IT infrastructure service based on a result of decoding a query string extracted from a URL included in a request transmitted from a terminal, into a graph in which terminals, servers, and hosts are nodes and accesses between the nodes are edges; a detection step of detecting an event that satisfies a predetermined condition regarding unauthorized use of the IT infrastructure service from the graph converted by the conversion step; Including, The analysis method is characterized in that the detection step detects an event that satisfies the condition based on the state of the request and information obtained from the server.

6. An analysis program for causing a computer to function as the analysis device according to any one of claims 1 to 4.

Images