Log generation device, abnormality detection system, log generation method and program

Abstract

A log generation device (10) is provided with an input operation log collection unit (11), an information log collection unit (12), and a generation unit (14). The input operation log collection unit (11) collects an input operation log that records operation events of an input device. The information log collection unit (12) collects an information log that, unlike the input operation log, records processing events associated with the processing by information equipment connected to the input device. On the basis of the information log and the input operation log, the generation unit (14) generates a user operation log including identification information of an application that is estimated from the input operation log and that performs processing. The generation unit (14) then generates, as a log group for abnormality detection, a user operation log group that includes user operation logs in an order according to the time of occurrence of operation events or processing events.

Description

[Technical field]

[0001] The present disclosure relates to a log generating device, an anomaly detection system, a log generating method, and a non-transitory computer-readable medium. [Background technology]

[0002] In recent years, cyber attacks targeting organizations have caused an increasing number of damages, such as information leaks and business interruptions, and there is a demand for strengthening measures against cyber attacks. Here, it is expected that the operational intentions of cyber attackers are different from those of legitimate users. Therefore, it has been proposed to collect logs of information devices as traces reflecting the operational intentions, and to use these logs to detect anomalies.

[0003] For example, Patent Document 1 discloses a log analysis device that detects anomalies in information devices by comparing the past and present frequency distribution of time intervals between a log of a physical facility management device and a log of an information device that executes information processing by user operation. Patent Document 1 describes that the access log of a file server can be used as the log of the information device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2015 / 186155 Summary of the Invention [Problem to be solved by the invention]

[0005] Here, when a user of an information device uses multiple applications in a series of operations, the user's intentions in the series of operations must be taken into consideration in detecting anomalies. However, the method described in the above-mentioned Patent Document 1 has a problem in that the user's intentions in the series of operations cannot be fully taken into consideration because it simply uses the access log of the file server as the log of the information device.

[0006] In view of the above-mentioned problems, an object of the present disclosure is to provide a log generation device, an anomaly detection system, a log generation method, and a non-transitory computer-readable medium that are capable of generating a log that reflects a series of operational intentions of a user who uses an information device. [Means for solving the problem]

[0007] A log generating device according to an aspect of the present disclosure includes an input operation log collecting means, an information log collecting means, and a generating means. The input operation log collecting means collects an input operation log in which an operation event of an input device is recorded. The information log collecting means collects an information log in which a processing event related to a processing of an information device connected to the input device is recorded, which is different from the input operation log. The generating means generates a user operation log based on the information log and the input operation log, the user operation log including identification information of an application inferred from the input operation log and including identification information of an application in which the processing is executed. The generating means then generates a user operation log group including the user operation logs in an order according to an occurrence time of an operation event or a processing event as a log group for abnormality detection.

[0008] An anomaly detection system according to one aspect of the present disclosure includes the log generating device and an anomaly detection device that detects an anomaly using the group of user operation logs.

[0009] A log generation method according to one aspect of the present disclosure collects an input operation log in which operation events of an input device are recorded, collects an information log that is different from the input operation log and in which processing events related to processing of an information device connected to the input device are recorded, generates a user operation log based on the information log and the input operation log, the user operation log including identification information of an application inferred from the input operation log and identification information of an application on which the processing is executed, and generates a user operation log group including the user operation logs in an order according to a time at which an operation event or a processing event occurs, as a log group for anomaly detection.

[0010] A non-transitory computer-readable medium according to one aspect of the present disclosure stores a program that causes a computer to execute an input operation log collection process that collects an input operation log in which operation events of an input device are recorded; an information log collection process that collects an information log in which processing events related to processing of an information device connected to the input device are recorded, which is different from the input operation log; and a generation process that generates a user operation log based on the information log and the input operation log, the user operation log including identification information of an application on which the processing is executed, the identification information being estimated from the input operation log, and generates a user operation log group including the user operation logs in an order according to the occurrence time of an operation event or a processing event, as a log group for anomaly detection. Effect of the Invention

[0011] The present disclosure makes it possible to provide a log generating device, an anomaly detection system, a log generating method, and a non-transitory computer-readable medium that are capable of generating a log that reflects a series of operational intentions of a user who uses an information device. [Brief description of the drawings]

[0012] [Figure 1] 1 is a block diagram showing a configuration of a log generating device according to a first embodiment. [Diagram 2] 1 is a flowchart showing the flow of a log generating method according to the first embodiment. [Diagram 3] FIG. 11 is a schematic configuration diagram of an anomaly detection system according to a second embodiment. [Figure 4] FIG. 11 is a block diagram showing a configuration of an information device according to a second embodiment. [Diagram 5] FIG. 11 is a diagram illustrating an example of a data structure of an input operation log before processing according to the second embodiment. [Figure 6] FIG. 11 is a diagram illustrating an example of a data structure of a processed input operation log according to the second embodiment. [Figure 7] FIG. 11 is a diagram showing an example of a data structure of a web access log before processing according to the second embodiment. [Figure 8] FIG. 11 is a diagram showing an example of a data structure of a processed web access log according to the second embodiment. [Figure 9] FIG. 11 is a diagram showing an example of a data structure of a file access log before processing according to the second embodiment. [Figure 10] FIG. 11 is a diagram showing an example of a data structure of a processed file access log according to the second embodiment. [Figure 11] 11 is a flowchart showing an example of the flow of a log generating method according to a second embodiment. [Figure 12] FIG. 11 is a diagram illustrating an example of a data structure of a user operation log group according to the second embodiment. [Figure 13] FIG. 11 is a block diagram showing a configuration of an abnormality detection device according to a second embodiment. [Figure 14] FIG. 11 is a diagram showing an example of a data structure of a calculation command according to the second embodiment. [Figure 15] 11 is a flowchart showing an example of the flow of an anomaly detection method according to the second embodiment. [Figure 16] 13 is a diagram for explaining pre-processing of a group of user operation logs, classification processing into windows, and generation processing of an appearance frequency vector according to the second embodiment. FIG. [Figure 17] FIG. 11 is a diagram for explaining a window similarity generation process according to the second embodiment. [Figure 18] FIG. 11 is a block diagram showing a configuration of an information device according to a third embodiment. [Figure 19] FIG. 11 is a block diagram showing the configuration of an abnormality detection device according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, the present disclosure will be described through embodiments, but the disclosure according to the claims is not limited to the following embodiments. In addition, all of the configurations described in the embodiments are not necessarily essential as means for solving the problems. In each drawing, the same elements are given the same reference numerals, and duplicated explanations are omitted as necessary.

[0014] First, an overview of this embodiment will be described. The contents of user operations are mainly recorded in operation events of input devices such as a mouse or keyboard. An operation event of an input device is considered to be the smallest unit that represents an interaction between an information device and a user who uses it. However, only the operation type, the time of event occurrence, and the application process number that is the target of the event can be obtained from the operation event of the input device. The operation event of the input device does not include information indicating the user's operation intention, such as what file name the user gave to the file and in which directory the file was saved, or what URL (Uniform Resource Locator) the user clicked on a button on a web page to transition to. Therefore, it is difficult to grasp a series of operation intentions of the user just by tracking the operation events of the input device. This problem occurs particularly prominently when a user uses multiple applications. Therefore, in this embodiment, a group of user operation logs is generated in which the operation events of the input device are supplemented with information indicating the user's operation intention by combining other types of logs of the information device based on the operation events of the input device.

[0015] <Embodiment 1> First, a first embodiment of the present disclosure will be described. Fig. 1 is a block diagram showing a configuration of a log generating device 10 according to the first embodiment. The log generating device 10 is a computer device that generates a log group for anomaly detection. The log generating device 10 includes an input operation log collecting unit 11, an information log collecting unit 12, and a generating unit 14.

[0016] The input operation log collection unit 11 is also called an input operation log collection means. The input operation log collection unit 11 collects an input operation log. Here, the input operation log is a log in which operation events of an input device are recorded. The input device is an input device connected to an information device. An operation event of the input device occurs when a user operates the input device.

[0017] The information log collection unit 12 is also called information log collection means. The information log collection unit 12 collects information logs. The information log is a log in which processing events related to processing of an information device are recorded, and is different from an input operation log. The information log collection unit 12 may collect information logs corresponding to a plurality of applications.

[0018] The generating unit 14 generates a user operation log based on the information log and the input operation log. The generated user operation log includes identification information (application ID) of an application in which the above-mentioned process of the above-mentioned information device is executed. The application ID is estimated from the input operation log. For example, the generating unit 14 generates a user operation log by applying information of an information log in which a processing event occurs at the same time as an operation event of the input operation log to information of the user's input operation log. The generating unit 14 can generate a log that complements the user's operation intention in multiple applications by using information logs corresponding to multiple applications. Then, the generating unit 14 generates a user operation log group that includes the user operation logs in chronological order. Here, "including in chronological order" means including in an order according to the occurrence time of an operation event of an input operation or a processing event of the above-mentioned process.

[0019] FIG. 2 is a flowchart showing a flow of the log generating method according to the first embodiment. First, the input operation log collecting unit 11 of the log generating device 10 collects input operation logs (S10). Next, the information log collecting unit 12 collects information logs (S11). Next, the generating unit 14 generates a user operation log based on the collected information logs and input operation logs (S12). At this time, the generating unit 14 includes an application ID of an application estimated from the input operation log in the user operation log. Next, the generating unit 14 arranges the user operation logs in chronological order, and generates a user operation log group including the user operation logs in chronological order (S13).

[0020] Thus, according to the first embodiment, the log generating device 10 complements the information of the input operation log with the information of the information log, generates a user operation log including an application ID, and generates a user operation log group as a time-series sequence. Therefore, even if a user uses multiple applications, a log group for anomaly detection that reflects a series of operation intentions of the user can be generated. This can improve the accuracy of anomaly detection.

[0021] <Embodiment 2> Next, a second embodiment of the present disclosure will be described. FIG. 3 is a schematic configuration diagram of an anomaly detection system 1 according to the second embodiment. The anomaly detection system 1 is a computer system that detects whether an anomaly has occurred in an information device to be monitored. An anomaly indicates, for example, that a third party illegally operates a user's information device, that a third party has intruded into the information device's system through illegal operation and illegally taken out information, or that the information device's system is subjected to a cyber attack. The anomaly detection system 1 includes information devices 100-1, 100-2, and 100-3, input devices 150-1, 150-2, and 150-3 connected to the information devices 100-1, 100-2, and 100-3, an anomaly detection device 200, and a management device 300.

[0022] In the following, when referring to any of the information devices 100-1, 100-2, and 100-3, it may be simply referred to as information device 100, and when referring to any of the input devices 150-1, 150-2, and 150-3, it may be simply referred to as input device 150. The number of information devices 100 and input devices 150 is not limited to three, and may be one or two, or may be more than three.

[0023] The information device 100, the error detection device 200, and the management device 300 are connected to a network N.

[0024] The information device 100 is an information device to be monitored. The information device 100 accepts an input operation from a user via an input device 150, and executes information processing according to the input operation. Event information of the input operation accepted by the information device 100 is recorded in an input operation log. Furthermore, processing event information related to information processing executed on the information device 100 is recorded in an information log. The information log is different from the input operation log. The information log is a log recorded by each application, and may be a web access log, a file access log, or the like. Furthermore, the information log may be a system log recorded by an OS (Operating System), or may be a log recorded outside the information device, for example, a proxy log or a log recorded on a SIEM (Security Information and Event Management).

[0025] The information device 100 collects input operation logs and information logs, and generates a group of user operation logs reflecting a series of user operation intentions based on the collected information logs and input operation logs. In other words, the information device 100 corresponds to the log generating device 10 of the above-mentioned first embodiment. The information device 100 transmits the generated group of user operation logs to the anomaly detection device 200 via the network N.

[0026] The input device 150 is, for example, a mouse, a keyboard, or a touch panel.

[0027] The management device 300 is a computer device that monitors and manages the information devices 100 connected to the network N. When a device other than the anomaly detection device 200 detects a suspected anomaly in the information devices 100, the management device 300 transmits a calculation command to the anomaly detection device 200. The calculation command is a command to execute a calculation for anomaly detection using a group of user operation logs. The management device 300 may also transmit the calculation command to the anomaly detection device 200 periodically.

[0028] The anomaly detection device 200 receives and accumulates user operation logs from the information device 100 via the network N. Then, in response to receiving a calculation command from the management device 300, the anomaly detection device 200 detects an anomaly using the user operation logs. For example, the anomaly detection device 200 compares user operation logs received from the target information device 100 for different periods, and detects an anomaly based on the comparison result. Then, the anomaly detection device 200 transmits the anomaly detection result to the management device 300. Alternatively, when an anomaly is detected, the anomaly detection device 200 transmits alert information to the management device 300 or the information device 100.

[0029] 4 is a block diagram showing a configuration of an information device 100 according to embodiment 2. The information device 100 includes an input operation log collection unit 101, an information log collection unit 102, a storage unit 103, a generation unit 104, and a transmission unit 105.

[0030] The input operation log collection unit 101 is an example of the above-mentioned input operation log collection unit 11. The input operation log collection unit 101 collects input operation logs from a storage device (not shown) in the information device 100. Here, the raw input operation log collected by the input operation log collection unit 101 may be called an unprocessed input operation log. The input operation log collection unit 101 processes the unprocessed input operation log into a predetermined data structure, and stores the processed input operation log in the storage unit 103.

[0031] The information log collection unit 102 is an example of the above-mentioned information log collection unit 12. The information log collection unit 102 collects information logs. The collected information logs include information logs in which different applications execute processing. For example, the information log collection unit 102 acquires information logs (web access logs, file access logs, system logs, etc.) from a storage device (not shown) in the information device 100. Also, for example, the information log collection unit 102 acquires information logs (proxy logs, SIEM logs, etc.) from an external device connected to the information device 100. Here, the raw information logs acquired by the information log collection unit 102 may be called information logs before processing. The information log collection unit 102 processes the information logs before processing into a predetermined data structure, and stores the processed information logs in the storage unit 103.

[0032] The storage unit 103 is also called a storage means. The storage unit 103 is a storage medium that stores the processed input operation log and the processed information log.

[0033] The generating unit 104 is an example of the generating unit 14 described above. The generating unit 104 generates a user operation log by complementing the information of the processed input operation log with the information of the processed information log. First, the generating unit 104 acquires the processed input operation log and the processed information log stored in the storage unit 103. For each of the processed input operation logs, the generating unit 104 identifies an application ID of an application in which an input operation is executed from the input operation log. Then, the generating unit 104 generates input operation information. The input operation information includes at least the application ID and the occurrence time of an operation event. The input operation information may further include at least one of information indicating the type of input operation (operation type) and information on the target of the input operation.

[0034] Then, the generating unit 104 judges whether or not there is a processed information log corresponding to the processed input operation log. The processed information log corresponding to the processed input operation log is present when there is a processed information log of a processing event that occurred at the same time as the occurrence time of the operation event of the processed input operation log. When there is a processed information log corresponding to the processed input operation log, the generating unit 104 generates one or more user operation logs based on the information included in the processed information log and the input operation information. Specifically, the generating unit 104 generates a user operation log by adding the input operation information to the information included in the processed information log, or by integrating the information included in the processed information log and the input operation information. Note that when there is no processed information log corresponding to the processed input operation log, the generating unit 104 generates a user operation log based on the input operation information. Specifically, the generating unit 104 generates the input operation information as a user operation log.

[0035] The generating unit 104 then generates, as a user operation log group, a sequence in which the multiple user operation logs are arranged in order according to the occurrence times of the operation events or processing events. The generating unit 104 supplies the generated user operation log group to the transmitting unit 105.

[0036] The transmission unit 105 is also called a transmission means. The transmission unit 105 transmits the user operation logs to the anomaly detection device 200 via the network N.

[0037] 5 is a diagram showing an example of a data structure of an input operation log before processing according to the second embodiment. The input operation log before processing includes an operation event type (event_type), an occurrence time (time) of the operation event, an application ID (window_name) of the application that was the target of the input operation, and the target of the input operation. The target of the input operation includes, for example, path information "gui_path" of the selected target in the case of a selection operation, and input key information "input" in the case of a keyboard operation. In addition, in the case of a selection operation, the input operation log before processing may include position information (coordinate) of the selected GUI as information related to the target of the input operation.

[0038] FIG. 6 is a diagram showing an example of a data structure of the processed input operation log according to the second embodiment. The input operation log collection unit 101 extracts, for each log, from the input operation log before processing, an operation event type (name=Event Type), an occurrence time of the operation event (time=Time), an application ID (window_name=Window Name), and information related to the target of the input operation (gui_path=GUI Path, Values). "Velues" in this figure may be input key information (input) or position information (coordinate) of the selected GUI. Then, the input operation log collection unit 101 processes the extracted information into the data structure shown in this figure. As a result, the input operation log collection unit 101 generates processed input operation logs 400 to 402.

[0039] 7 is a diagram showing an example of the data structure of a web access log before processing according to the second embodiment. In a web access, a process and a process event may be called an access and an access event, respectively. The web access log before processing includes the occurrence time (time) of the access event, and the accessed URL (url) as information related to the target of processing. The web access log before processing may also include the access event name (name).

[0040] 8 is a diagram showing an example of the data structure of a processed web access log according to the second embodiment. The information log collection unit 102 extracts, for each log, from the web access log before processing, the time of occurrence of the access event (time=Time) and information related to the target of processing (url=URL). In this example, the information log collection unit 102 also extracts the access event name (name=Event Type). The information log collection unit 102 then processes the extracted information into the data structure shown in this figure. As a result, the information log collection unit 102 generates processed information logs 500 to 502.

[0041] FIG. 9 is a diagram showing an example of the data structure of a file access log before processing according to the second embodiment. In the case of file access, a process and a process event may be called an access and an access event, respectively. The file access log before processing includes the occurrence time (time) of the access event, and path information (path) of the accessed file data as information on the processing target. If the accessed file data has been renamed in the past, the information on the processing target further includes path information (old_path) of the file data before renaming. The file access log before processing may also include other information such as the access event name (name) and the action type (action).

[0042] FIG. 10 is a diagram showing an example of the data structure of a processed file access log according to the second embodiment. The information log collection unit 102 extracts, for each log, from the file access logs before processing, the time of occurrence of an access event (time=Time) and information on the target of processing (path information (path=Path) of the accessed file data in this figure). In this example, the information log collection unit 102 also extracts path information (old_path=Old Path) of the file data before renaming, the access event name (name=Event Type), and the action type (action=Action). Then, the information log collection unit 102 processes the extracted information into the data structure shown in this figure. As a result, the information log collection unit 102 generates processed information logs 600 to 601.

[0043] FIG. 11 is a flowchart showing an example of the flow of the log generating method according to the second embodiment. First, the generating unit 104 of the information device 100 acquires the processed input operation log from the storage unit 103 (S20). Next, the generating unit 104 identifies the application in which the input operation is executed based on the processed input operation log (S21). Specifically, the generating unit 104 extracts an application ID ("Window Name" in FIG. 6) from the processed input operation log to identify the application. The generating unit 104 may estimate the application ID based on path information of the selection target ("GUI Path" in FIG. 6) or position information of the selected GUI ("Values ​​coordinate" in FIG. 6) included in the processed input operation log. In this case, the information device 100 may previously store a table that associates path information or GUI position information with the application ID. In the following, the "processed input operation log" is simply called the "input operation log" and the "processed information log" is simply called the "information log".

[0044] Next, the generating unit 104 generates input operation information including the specified application ID and the operation type included in the input operation log (S22). Note that the input operation information may include information related to the target of the input operation.

[0045] Next, the generating unit 104 judges whether or not there is an information log corresponding to the input operation log among the information logs stored in the storage unit 103 (S23). Specifically, the generating unit 104 judges whether or not there is an information log among the information logs stored in the storage unit 103 in which the occurrence time of a processing event matches the occurrence time of an operation event in the input operation log. Then, the generating unit 104 extracts the information log with the matching occurrence time. At this time, the generating unit 104 may extract only the information log in which the degree of correlation between the access event name or information on the processing target included in the information log and the path information on the selected target or the position information on the selected GUI included in the input operation log is equal to or greater than a predetermined value.

[0046] If there is an information log corresponding to the input operation log (Yes in S23), the generating unit 104 generates a user operation log including the information included in the information log and the input operation information (S24). Then, the generating unit 104 advances the process to S26.

[0047] On the other hand, if there is no information log corresponding to the input operation log (No in S23), the generating unit 104 generates a user operation log including the input operation information (S25). Then, the generating unit 104 advances the process to S26.

[0048] In S26, the generation unit 104 determines whether or not there is an unprocessed input operation log among the input operation logs stored in the storage unit 103. Then, as long as there is an unprocessed input operation log, the generation unit 104 repeats the processes shown in S20 to S26.

[0049] If there are no unprocessed input operation logs (No in S26), the generating unit 104 generates a user operation log group in which the user operation logs are arranged in order according to the occurrence time of the operation events (S27). Then, the transmitting unit 105 transmits the user operation log group to the anomaly detection device 200 via the network N (S28).

[0050] 12 is a diagram showing an example of a data structure of a user operation log group according to embodiment 2. The user operation log group shown in this figure includes user operation logs 700 to 703. Note that "Time", "Application ID", and "Operation Type" are information included in input operation information.

[0051] For example, the occurrence time of an operation event in the input operation log 400 does not match any of the occurrence times of processing events in the information logs 500-502 and 600-601. Therefore, the generation unit 104 determines that there is no information log corresponding to the input operation log 400 (No in S23 of FIG. 11). Then, the generation unit 104 generates a user operation log 700 including the input operation information of the input operation log 400 (S25 of FIG. 11). Note that, for information in the user operation log 700 that is not included in the input operation information (for example, "Target", which is information related to the target of processing), "null" may be added.

[0052] Also, for example, the occurrence time of an operation event in the input operation log 401 coincides with the occurrence time of a processing event in the information log 502. Therefore, the generation unit 104 determines that there is an information log corresponding to the input operation log 401 (Yes in S23 of FIG. 11). Then, the generation unit 104 generates a user operation log 701 that integrates the input operation information in the input operation log 401 and the URL (information related to the processing target) included in the information log 502 (S24 of FIG. 11).

[0053] In this way, according to the information device 100 of the second embodiment, the input operation log is supplemented with the information log, a user operation log including an application ID is generated, and a user operation log group is generated as a time-series sequence. Therefore, even when a user uses multiple applications, it is possible to generate a log group for anomaly detection that reflects the interaction between the user and the information device (for what, what operation, and when) as a series of operation intentions of the user.

[0054] 13 is a block diagram showing the configuration of an abnormality detection device 200 according to embodiment 2. The abnormality detection device 200 includes a log collection unit 201, a user operation log storage unit 202, a calculation command receiving unit 203, a calculation unit 204, a determination unit 205, and an alert notification unit 206.

[0055] The log collection unit 201 is also called a log collection means. The log collection unit 201 collects a plurality of user operation log groups from each of one or a plurality of information devices 100. The log collection unit 201 stores the collected user operation log groups in the user operation log storage unit 202 in association with the ID of the information device 100.

[0056] The user operation log storage unit 202 is also called a user operation log storage unit, and is a storage medium that stores a group of user operation logs.

[0057] The calculation command receiving unit 203 is also called a calculation command receiving means. The calculation command receiving unit 203 receives a calculation command from the management device 300. In the second embodiment, the calculation command includes a plurality of calculation parameter values ​​used in processing by the calculation unit 204, which will be described later. In response to receiving a calculation command, the calculation command receiving unit 203 supplies the calculation command to the calculation unit 204 .

[0058] The calculation unit 204 is also called a calculation means. The calculation unit 204 extracts user operation log groups to be compared from the user operation log storage unit 202 using a part of the calculation parameter values ​​included in the calculation command. Then, the calculation unit 204 calculates the similarity between the user operation log groups to be compared using a part of the calculation parameter values. At this time, the calculation unit 204 calculates the similarity between the user operation log groups using at least the application ID included in the user operation logs constituting the user operation log groups to be compared and the operation type included in the user operation logs.

[0059] The determination unit 205 is also called a determination means. The determination unit 205 determines whether or not an abnormality has been detected based on the similarity between the user operation log groups to be compared, calculated by the calculation unit 204. For example, the determination unit 205 determines that an abnormality has been detected when the similarity between the user operation log groups is less than a predetermined threshold. The determination unit 205 supplies the determination result to the alert notification unit 206.

[0060] The alert notification unit 206 is also called an alert notification means. When an abnormality is detected, the alert notification unit 206 issues an abnormality alert. For example, the alert notification unit 206 issues an abnormality alert to the management device 300.

[0061] FIG. 14 is a diagram illustrating an example of a data structure of a calculation command according to the second embodiment. For example, the calculation command includes an information device ID related to the user operation log group to be compared, a comparison period for the user operation log group, a window period, and a threshold value.

[0062] The information device ID and the comparison period are used in the process of extracting a group of user operation logs to be compared. The window period and the threshold value are used in the process of calculating the similarity between the user operation logs to be compared.

[0063] 15 is a flowchart showing an example of the flow of the anomaly detection method according to embodiment 2. First, when the calculation command receiving unit 203 of the anomaly detection device 200 receives a calculation command (Yes in S30), it supplies the calculation command to the calculation unit 204 and proceeds to S31.

[0064] In S31, the calculation unit 204 calculates a user operation log group S corresponding to the information device ID and the comparison period by using the information device ID and the comparison period included in the calculation command. a ',S b ' to get '.

[0065] Then, the calculation unit 204 performs the processes shown in S32 to S34 on the acquired user operation log set S a ',S b 'Repeat every '.

[0066] In S32, the calculation unit 204 performs pre-processing on the user operation log group. a ',S b ', respectively, S a ,S b In S33, the calculation unit 204 classifies the user operation logs included in the user operation log group into windows using the window period included in the calculation command. For example, when the window period is 1 (Hour), the calculation unit 204 creates a window of "0:00:00-0:59:59", a window of "1:00:00-1:59:59", ..., and classifies the user operation log into one of the windows based on the event occurrence time (Time). In S34, the calculation unit 204 generates an occurrence frequency vector for each window, with the TF-IDF (Term Frequency - Inverse Document Frequency) value of the character string of each user operation log as an element.

[0067] Hereinafter, the occurrence frequency vector is expressed as follows:

number

[0068] FIG. 16 is a diagram for explaining the pre-processing of the user operation log group, the classification process into windows, and the generation process of the occurrence frequency vector according to the second embodiment. This diagram shows the user operation log group S corresponding to the comparison period "B" of the information device ID "0001". b', classification into windows, and generation of an occurrence frequency vector. For example, the calculation unit 204 performs preprocessing on the user operation log set S b ' combines the character string of the application ID (Application ID) and the character string of the operation type (Operation Type) of each user operation log included in the user operation log set S '. As a result, the calculation unit 204 creates a user operation log set S ' including user operation logs in which the event occurrence time (Time) and the combined character string (Text) are associated with each other. b Generate.

[0069] Then, the calculation unit 204 calculates the user operation log group S b For example, the calculation unit 204 classifies the user operation logs included in the user operation log group S b Among the user operation logs included in the table, the user operation logs whose event occurrence time (Time) is included in the window of "11:00:00-11:59:59" are extracted and arranged in the order of event occurrence time to create a user operation log group S b,n Generate S b,n indicates a group of user operation logs corresponding to the n-th window.

[0070] Then, the calculation unit 204 calculates the user operation log group S b,n Each user operation log S included in b,n 1 ,S b,n 2 ,S b,n 3 For the string (Text), the user operation log group S b The calculation unit 204 calculates a TF-IDF value using the character strings (Text) of all the user operation logs included in the user operation log set S as a corpus. b,n All user operation logs included in S b,n 1 ,S b,n 2 ,S b,n 3In this case, the calculation unit 204 arranges the TF-IDF values ​​in the occurrence frequency vector in the order of occurrence time of the operation events.

[0071] In this way, the calculation unit 204 calculates the user operation log S b,n 1 ,S b,n 2 ,S b,n 3 The user operation log group S from which the data was extracted b The occurrence frequency vector in each user operation log S b,n 1 ,S b,n 2 ,S b,n 3 The calculation unit 204 calculates the application ID and operation type included in the user operation log group S a Similarly, the occurrence frequency vector is calculated for

[0072] Returning to FIG. 15, the description will be continued. The calculation unit 204 calculates the user operation log group S a The occurrence frequency vector v calculated for a given window (e.g., the nth window) of Sa,n and user operation log group S b The occurrence frequency vector v calculated for a given window Sb,n The window similarity is calculated by comparing the user operation log group S a ,S b The window similarity is the degree of similarity between character strings of user operation logs included in a predetermined window between the user operation logs S a ,S b is the similarity of the occurrence frequency vectors calculated for a predetermined window between the

[0073] FIG. 17 is a diagram for explaining the process of generating window similarities according to the second embodiment. Each of the circles in this diagram is a part of the user operation log set S. a ,S bThe calculation unit 204 symbolizes the character string (Text) of the user operation log included in the user operation log set S. The dashed line in this figure indicates the n-th window (Window(n)). a ,S b The occurrence frequency vector v for each n-th window of Sa,n ,v Sb,n The occurrence frequency vector v Sa,n ,v Sb,n can be considered to represent the operation tendency of each of the n-th windows. Then, the calculation unit 204 calculates the two occurrence frequency vectors v Sa,n ,v Sb,n The window similarity is calculated by comparing the window similarity values. For example, cosine similarity can be used as the window similarity value. After calculating the window similarity value of the n-th window, the calculation unit 204 slides the window and proceeds to the calculation process of the window similarity value of the n+1-th window. In this manner, the calculation unit 204 calculates the window similarities of all windows.

[0074] Returning to Fig. 15, the description will be continued. The calculation unit 204 calculates a user operation log set S for a comparison period based on the window similarities of all windows. a ,S b The similarity between the two is calculated (S36).

[0075] For example, a user operation log group S a ,S b The similarity between them can be expressed as follows:

number

[0076] Therefore, the penalty length can be expressed as follows:

number

[0077] In this way, the calculation unit 204 calculates the user operation log group S a and user operation log group S b The similarity between the user operation log set S a ,S b The similarity of the user operation logs included in the window (window similarity cos(v Sa,n ,v Sb,n In this way, the calculation unit 204 can easily calculate the similarity. In the second embodiment, the calculation unit 204 calculates the similarity based on each user operation log group S a ,S b The similarity is calculated by further using the difference in the number of user operation logs included in the user operation logs S as a constraint condition. By imposing such a constraint condition on the similarity, the user operation log group S a ,S b If the difference in length between the two is large, the value of Similarity can be adjusted to be smaller, thereby improving the accuracy of the calculation of Similarity.

[0078] The calculation unit 204 calculates the user operation log group S a ,S bIn the calculation of the similarity of the user operation log set S a ,S b A constraint related to the number of user operation logs included in the n-th window is imposed. Instead of or in addition to this, the calculation unit 204 may calculate the window similarity of the n-th window by further using "information on the target of the input operation" in each user operation log included in the n-th window between each user operation log group as a constraint. This makes it possible to adjust the similarity to a smaller value when the characteristics of the URL or file path of the user operation logs included in the window are significantly different.

[0079] 15, the process (S34) of calculating the occurrence frequency vectors of all windows included in the user operation log group is completed before S35 of comparing the window similarities. However, instead of this, the calculation unit 204 may execute the processes shown in S34 to S35 as a series of processes for each window. In other words, the calculation unit 204 may execute the series of processes shown in S34 to S35 while sliding the window.

[0080] In this way, according to the anomaly detection device 200 of the second embodiment, the time series sequence of the user operation log including the application ID is used as a group of user operation logs reflecting a series of user operation intentions for anomaly detection, thereby improving the accuracy of anomaly detection.

[0081] <Embodiment 3> Next, a third embodiment of the present disclosure will be described. The anomaly detection system 1 according to the third embodiment includes an information device 100a and an anomaly detection device 200a instead of the information device 100 and the anomaly detection device 200. The information device 100a transmits an input operation log (after processing) and an information log (after processing) to the anomaly detection device 200a. The anomaly detection device 200a generates and accumulates a user operation log group based on the received input operation log and information log. That is, in the third embodiment, the anomaly detection device 200a corresponds to the log generation device 10. The anomaly detection process is the same as that of the anomaly detection device 200.

[0082] 18 is a block diagram showing a configuration of an information device 100a according to the third embodiment. The information device 100a differs from the information device 100 in that the generation unit 104 is omitted and a transmission unit 105a is provided instead of the transmission unit 105. The transmission unit 105a transmits the input operation log and the information log stored in the storage unit 103 to the abnormality detection device 200a.

[0083] 19 is a block diagram showing a configuration of an abnormality detection device 200a according to the embodiment 3. The abnormality detection device 200a differs from the abnormality detection device 200 in that the abnormality detection device 200a includes a log collection unit 201a instead of the log collection unit 201, and a generation unit 104a.

[0084] The log collection unit 201a collects input operation logs and information logs from one or more information devices 100a, and supplies the collected input operation logs and information logs to the generation unit 104a.

[0085] The generating unit 104a generates a user operation log group based on the input operation log and the information log, similarly to the generating unit 104 of the information device 100 in the second embodiment. Then, the generating unit 104a stores the generated user operation log group in the user operation log storage unit 202.

[0086] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. For example, in the above-described embodiment, the anomaly detection device 200 uses an occurrence frequency vector whose elements are the TF-IDF values ​​of the character strings in the user operation log. However, the anomaly detection device 200 may use any other vector instead, as long as the element is a numerical value expressing the characteristics of the character strings in the user operation log.

[0087] Although the above-described embodiment has been described as a hardware configuration, the present disclosure is not limited to this. Any process of the present disclosure can be realized by causing a CPU to execute a computer program.

[0088] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disc (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, the transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0089] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) an input operation log collecting means for collecting an input operation log in which operation events of an input device are recorded; an information log collection means for collecting an information log, which is different from the input operation log and in which a processing event related to processing of an information device connected to the input device is recorded; a generating means for generating a user operation log based on the information log and the input operation log, the user operation log including identification information of an application for executing the process, the identification information being estimated from the input operation log, and generating a user operation log group including the user operation logs in an order according to an occurrence time of an operation event or a processing event as a log group for abnormality detection; A log generating device comprising: (Appendix 2) The collected information logs include information logs in which the applications in which the processes are executed are different from each other. 2. A log generating device as described in claim 1. (Appendix 3) The user operation log includes identification information of the application, and input operation information including at least one of an occurrence time of the operation event, information indicating a type of the input operation, and information regarding a target of the input operation. 3. A log generating device according to claim 1 or 2. (Appendix 4) The generating means includes: Identifying an application in which an input operation is executed for each of the input operation logs; When there is an information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event, the user operation log is generated based on the information log and the input operation information. 4. A log generating device as described in appendix 3. (Appendix 5) The generating means generates the user operation log based on the input operation information when there is no information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event. 5. The log generating device according to claim 3 or 4. (Appendix 6) A log generating device according to any one of claims 1 to 5; an anomaly detection device that detects anomalies using the user operation logs; An anomaly detection system comprising: (Appendix 7) The abnormality detection device includes: A log collection means for collecting a plurality of user operation logs; a calculation means for calculating a similarity between the user operation log groups by using at least identification information of an application included in the user operation logs constituting each of the user operation log groups and a type of an input operation included in the user operation logs; a determination means for determining whether or not the abnormality has been detected based on the similarity between the user operation logs; Equipped 7. The anomaly detection system of claim 6. (Appendix 8) The calculation means is For each of the user operation log groups, extracting user operation logs included in a window indicating a predetermined period from the user operation log group; Calculating a similarity between each of the user operation log groups based on a window similarity between the user operation log groups of the user operation logs included in the window extracted for each of the user operation log groups. 8. The anomaly detection system of claim 7. (Appendix 9) the calculation means calculates a vector indicating an appearance frequency in each of the user operation log groups of the extracted user operation logs, using identification information of an application included in each of the extracted user operation logs and a type of an input operation included in each of the extracted user operation logs; Calculating the window similarity using the vector calculated for the window in one user operation log group and the vector calculated for the window in the other user operation log group. 9. The anomaly detection system of claim 8. (Appendix 10) The calculation means calculates the window similarity by further using information on a target of the input operation included in each of the user operation logs included in the window between the respective user operation log groups. 10. The anomaly detection system of claim 9. (Appendix 11) The calculation means further uses a difference in the number of user operation logs included in each of the user operation log groups to calculate a similarity between each of the user operation log groups. 11. The anomaly detection system of any one of claims 7 to 10. (Appendix 12) The device further includes an alert notification unit that notifies an abnormality alert when the abnormality is detected. 12. The anomaly detection system of any one of claims 7 to 11. (Appendix 13) Collect an input operation log in which operation events of the input device are recorded; Collecting an information log that is different from the input operation log and that records a processing event related to a processing of an information device connected to the input device; generating a user operation log based on the information log and the input operation log, the user operation log including identification information of an application that is estimated from the input operation log and that is an identification information of an application that executes the process; A user operation log group including the user operation logs in an order according to the occurrence time of an operation event or a processing event is generated as a log group for detecting an anomaly. The log generation method. (Appendix 14) an input operation log collection process for collecting an input operation log in which operation events of the input device are recorded; an information log collection process for collecting an information log in which a processing event related to a processing of an information device connected to the input device is recorded, which is different from the input operation log; a generation process of generating a user operation log based on the information log and the input operation log, the user operation log including identification information of an application inferred from the input operation log, the identification information of the application for executing the process, and generating a user operation log group including the user operation logs in an order according to an occurrence time of an operation event or a processing event as a log group for abnormality detection; A non-transitory computer-readable medium on which a program for causing a computer to execute the program is stored. [Explanation of symbols]

[0090] 1 Anomaly Detection System 10 Log Generator 11 Input operation log collection unit 12 Information Log Collection Department 14 Generation part 100,100a Information equipment 101 Input operation log collection unit 102 Information Log Collection Department 103 Storage section 104,104a generation part 105,105a Transmitter 150 Input Device 200,200a Anomaly detection device 201 Log Collection Department 201a Log Collection Department 202 User operation log storage unit 203 Calculation command receiving unit 204 Calculation section 205 Judgment section 206 Alert notification section 300 Management device N Network

Claims

1. an input operation log collecting means for collecting an input operation log in which operation events of an input device are recorded; an information log collection means for collecting an information log, which is different from the input operation log and in which a processing event related to processing of an information device connected to the input device is recorded; a generating means for generating a user operation log based on the information log and the input operation log, the user operation log including identification information of an application for executing the process, the identification information being estimated from the input operation log, and generating a user operation log group including the user operation logs in an order according to an occurrence time of an operation event or a processing event as a log group for abnormality detection; Equipped with the user operation log includes, in addition to the identification information of the application, input operation information further including at least one of an occurrence time of the operation event, information indicating a type of the input operation, and information regarding a target of the input operation; The generating means includes: Identifying an application in which an input operation is executed for each of the input operation logs; generating the user operation log based on the information log and the input operation information when there is an information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event; When there is no information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event, the user operation log is generated based on the input operation information. Log generator.

2. The collected information logs include information logs in which the applications in which the processes are executed are different from each other. The log generating device according to claim 1 .

3. A log generating device according to claim 1 or 2; an anomaly detection device that detects anomalies using the user operation logs; An anomaly detection system comprising:

4. The abnormality detection device includes: A log collection means for collecting a plurality of user operation logs; a calculation means for calculating a similarity between the user operation log groups by using at least identification information of an application included in the user operation logs constituting each of the user operation log groups and a type of an input operation included in the user operation logs; a determination means for determining whether or not the abnormality has been detected based on the similarity between the user operation logs; Equipped The anomaly detection system according to claim 3 .

5. The calculation means is For each user operation log group, a user operation log included in a window indicating a predetermined period is extracted from the user operation log group; Calculating a similarity between each of the user operation log groups based on a window similarity between the user operation log groups, the window being included in the user operation log extracted for each of the user operation log groups. The anomaly detection system according to claim 4 .

6. the calculation means calculates a vector indicating an appearance frequency in each user operation log group of the extracted user operation logs, using identification information of an application included in each of the extracted user operation logs and a type of an input operation included in each of the extracted user operation logs; Calculating the window similarity using the vector calculated for the window in one user operation log group and the vector calculated for the window in the other user operation log group. The anomaly detection system according to claim 5 .

7. The calculation means calculates the window similarity by further using information on a target of the input operation included in each of the user operation logs included in the window between each group of user operation logs. The anomaly detection system of claim 6.

8. The calculation means further uses a difference in the number of user operation logs included in each user operation log group to calculate a similarity between each of the user operation log groups. The anomaly detection system according to any one of claims 4 to 7.

9. The device further includes an alert notification unit that notifies an abnormality alert when the abnormality is detected. The anomaly detection system according to any one of claims 4 to 7.

10. Collect an input operation log in which operation events of the input device are recorded; Collecting an information log that is different from the input operation log and that records a processing event related to a processing of an information device connected to the input device; generating a user operation log based on the information log and the input operation log, the user operation log including identification information of an application that is estimated from the input operation log and that is an identification information of an application that executes the process; generating a user operation log group including the user operation logs in an order according to an occurrence time of an operation event or a processing event as a log group for detecting an anomaly; the user operation log includes, in addition to the identification information of the application, input operation information further including at least one of an occurrence time of the operation event, information indicating a type of the input operation, and information regarding a target of the input operation; In the step of generating the user operation log, Identifying an application in which an input operation is executed for each of the input operation logs; generating the user operation log based on the information log and the input operation information when there is an information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event; When there is no information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event, the user operation log is generated based on the input operation information. The log generation method.

11. an input operation log collection process for collecting an input operation log in which operation events of the input device are recorded; an information log collection process for collecting an information log in which a processing event related to a processing of an information device connected to the input device is recorded, which is different from the input operation log; a generation process of generating a user operation log based on the information log and the input operation log, the user operation log including identification information of an application inferred from the input operation log, the identification information of the application for executing the process, and generating a user operation log group including the user operation logs in an order according to an occurrence time of an operation event or a processing event as a log group for abnormality detection; A program for causing a computer to execute the following: the user operation log includes, in addition to the identification information of the application, input operation information further including at least one of an occurrence time of the operation event, information indicating a type of the input operation, and information regarding a target of the input operation; In the generation process, Identifying an application in which an input operation is executed for each of the input operation logs; generating the user operation log based on the information log and the input operation information when there is an information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event; When there is no information log having an occurrence time of a processing event corresponding to the occurrence time of the operation event, the user operation log is generated based on the input operation information. program.

Images