Attack detection device, attack detection method, and attack detection program

Abstract

To provide an attack detection device, an attack detection method, and an attack detection program that enable early detection of various attacks carried out on a network.SOLUTION: An attack detection device 1 includes: an attack-associated information granting unit 11 configured to receive analysis target data for analyzing an attack executed on a network to grant attack-associated information, which is information associated with an attribute of an attack, to the analysis target data; an aggregation unit 12 configured to aggregate, with respect to the analysis target data to which the attack-associated information is granted, the number of observations for each predetermined item of the attack-associated information to record the aggregated number of observations as time-series data; and a detection unit 13 configured to determine, when time-series analysis is performed on the time-series data and it is determined that a predetermined change is seen in a time-series trend, that the attack has occurred, to output the time-series data and the attack-associated information that cause the determination.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an apparatus, a method, and a program for detecting attacks on a network. [Background technology]

[0002] DDoS attacks, which target specific servers on a network and send a large amount of traffic to them, disrupting their operation, and other activities have become a problem. A technology for early detection of attacks on a network is disclosed in, for example, Non-Patent Document 1. Non-Patent Document 1 proposes a method for detecting new vulnerability search activities (scans) based on changes in time series trends in information about traffic received by honeypots installed at multiple locations. Specifically, log information is collected periodically from multiple honeypots and registered in a database. The log information includes information such as communication protocol, source IP address, destination port number, number of accesses, and number of packets received per unit time. Based on the registered log information, the maximum values ​​of the communication protocol, number of accesses to the destination port number, and number of packets received per unit time are tallied for each honeypot to create time series data. Changes in the time series trends of the data are detected as change points by ChangeFinder, which uses, for example, two-stage learning and an SDAR (Sequentially Discounting Auto Regressive learning) algorithm. Change points detected by applying ChangeFinder can be estimated to be possible new attacks or changes in attack trends. It is said that new scans can be detected based on the number of packets received per unit time, which makes it possible to detect new DDoS attacks launched by attackers early and take measures against them. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Sho Yamamura, Mitsutoshi Kumagai, Kazunori Kamiya, Hiroshi Kurakami, "A study on early detection method of new scans using change point detection," Proceedings of Computer Security Symposium 2017, October 2017, pp.823-830 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the method proposed in Non-Patent Document 1 detects new types of scans based on changes in time-series trends by aggregating only data related to the traffic itself observed in the honeypot, such as source IP addresses, destination port numbers, and the number of packets received per unit time. Therefore, although this method is certainly useful for early detection of DDoS attacks, it has the problem that it is practically difficult to widely apply it to early detection of other attacks carried out on the network.

[0005] An object of the present invention is to provide an attack detection device, an attack detection method, and an attack detection program that enable early detection of various attacks carried out on a network. [Means for solving the problem]

[0006] An attack detection device according to one embodiment of the present invention comprises an attack-related information addition unit configured to receive analysis target data for analyzing attacks carried out on a network and add attack-related information, which is information related to the attributes of the attack, to the analysis target data; an aggregation unit configured to tally up the number of observations for each specified item of the attack-related information for the analysis target data to which the attack-related information has been added, and record the tallied number of observations as time series data; and a detection unit configured to perform time series analysis on the time series data, and when it is determined that a specified change has occurred in the time series trend, determine that the attack has occurred, and output the time series data and the attack-related information that caused the determination.

[0007] The detection unit may calculate an estimate of the time series data for a period to be analyzed based on the time series data recorded during a specified period, and determine whether there is a change in the time series trend using a threshold value set based on the estimate.

[0008] The system may also include a severity estimation unit configured to search for vulnerability information indicating vulnerabilities related to attacks on a network based on the attack-related information output from the detection unit, and if it is determined that there is vulnerability information related to the attack-related information, to output the vulnerability information.

[0009] The vulnerability information may be associated with the vulnerability information and may be information indicating the severity of the vulnerability information, and the severity estimation unit may output the severity information associated with the searched vulnerability information.

[0010] The severity information may be a current value calculated based on the attack-related information and based on a current assessment criterion of the Common Vulnerability Scoring System.

[0011] The data to be analyzed may be either traffic data acquired from a network, or a monitoring data log output from a monitoring device on the network.

[0012] In an attack detection method according to another aspect of the present invention, an information processing device receives analysis target data for analyzing attacks carried out on a network, assigns attack-related information to the analysis target data, which is information related to the attributes of the attack, counts the number of observations for each specified item of the attack-related information for the analysis target data to which the attack-related information has been assigned, records the counted number of observations as time series data, performs a time series analysis on the time series data, and if it is determined that a specified change has occurred in the time series trend, determines that the attack has occurred, and outputs the time series data and the attack-related information that caused the determination.

[0013] An attack detection program according to another aspect of the present invention is for causing a computer to function as the attack detection device. Effect of the Invention

[0014] According to the present invention, it is possible to detect various attacks carried out on a network at an early stage. [Brief description of the drawings]

[0015] [Figure 1] 2 is a diagram illustrating an example of a functional configuration of an attack detection device according to an embodiment of the present invention; [Diagram 2] 10 is a diagram illustrating a functional configuration of an attack-related information adding unit included in the attack detection device according to an embodiment; [Diagram 3] 13 is a diagram illustrating an example of the configuration of attack-related information added by an attack-related information adding unit in one embodiment. FIG. [Figure 4] 10A and 10B are diagrams illustrating an example of a process for detecting a change in a time series trend by an attack detection device according to an embodiment; [Diagram 5] 10 is a flowchart illustrating a processing procedure for attack detection performed by the attack detection device according to an embodiment. [Figure 6] FIG. 13 is a diagram illustrating a functional configuration of an attack detection device according to another embodiment of the present invention. [Figure 7] FIG. 13 is a diagram illustrating an example of the configuration of a correspondence table used by a seriousness estimation unit in another embodiment. [Figure 8] 13 is a flowchart showing a processing procedure for attack detection by an attack detection device according to another embodiment. [Figure 9] FIG. 13 is a diagram showing an example of the configuration of a severity display screen in another embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, the present invention will be described based on an embodiment with reference to the accompanying drawings. [Embodiment 1] First, an attack detection device according to an embodiment of the present invention will be described. The attack detection device in this embodiment takes in traffic data obtained from the network and monitoring logs output by monitoring devices on other networks (for example, Intrusion Detection Systems (IDS)) as data to be analyzed for attack detection, adds attack-related information indicating the attributes or nature of the attack to this data, and aggregates the data in a chronological order according to specified aggregation items to generate time-series data. The attack detection device then analyzes the time-series trends of the time-series data, and if it detects a change in the time-series trend, it determines that it has detected an attack or a sign of an attack and outputs that fact.

[0017] FIG. 1 is a diagram illustrating an example of a functional configuration of an attack detection device 1 according to the present embodiment. The attack detection device 1 is an information processing device (computer) such as a server or a personal computer, and includes a control unit 10, a storage unit 20, as well as various data input / output devices and communication devices.

[0018] The control unit 10 is a part that controls the entire attack detection device 1, and realizes each function of the attack detection device 1 in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a processor such as a CPU.

[0019] The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the attack detection device 1, and may be a ROM, a RAM, a flash memory, or a hard disk (HDD), etc. Specifically, the storage unit 20 stores a program (attack detection program) for causing the control unit 10 to execute each function of this embodiment, various parameters, intrusion detection rules, and time-series data to be processed by this program, etc.

[0020] The control unit 10 includes an attack-related information attachment unit 11 , a counting unit 12 , and a detection unit 13 . Using these functional units, the control unit 10 adds attack-related information to the data to be analyzed imported from the network and records it as time-series data.If a change based on predetermined criteria is detected in the time-series trend, it determines that an attack or a sign of an attack has been detected and outputs it together with the attack-related information.

[0021] The attack-related information adding unit 11 adds attack-related information to analysis target data acquired from a network. The analysis target data is, for example, traffic data acquired from the network, or log data acquired from other monitoring devices on the network. 2 shows an example of the configuration of the attack-related information adding unit 11 in this embodiment. The attack-related information adding unit 11 includes a related information adding unit 110 that has a function of adding attack-related information to the imported analysis target data.

[0022] When the data to be analyzed is traffic data, the attack-related information adding unit 11 includes the function of a general intrusion detection system (IDS) 120. The IDS 120 stores detection rules 121 that the IDS 120 uses to monitor traffic data. The detection rules 121 include, for example, the name of the rule, a rule identifier that is an identification code for identifying each rule, and an affected product and a vulnerability identifier as reference information. The affected product is the name of a product that is considered to be affected when it is determined that the corresponding detection rule matches the traffic data to be analyzed, and the vulnerability identifier is an identification code for identifying each vulnerability information, for example, Common Vulnerabilities and Exposures (CVE). The detection rules 121 may be stored in the storage unit 120. Examples of attack-related information derived from the detection results of the IDS 120 include the detection name (signature), attack type, attacked product, vulnerability identifier of the attacked target, traffic protocol (transport layer (TCP / UDP / ICMP), application layer (HTTP / SSH / DNS)), and benign / malicious judgment of the detection result.

[0023] When the data to be analyzed is log data acquired from another monitoring device such as an IDS, the attack-related information to be added is, for example, inspection result data obtained as a result of the monitoring device inspecting traffic data. In this case, the attack-related information adding unit 11 is not provided with an IDS 120 as illustrated in FIG. 2. The attack-related information adding unit 11 acquires log data from another monitoring device such as an IDS, and adds the attack-related information as illustrated above as attack-related information derived from the detection result of the monitoring device. FIG. 3 shows an example of adding attack-related information. The attack-related information is added to the data to be analyzed, and is stored in chronological order in the memory unit 20 as aggregated data.

[0024] The aggregation unit 12 aggregates the number of observations of the analysis target data per unit time for each pre-specified aggregation item in time series based on the analysis target data to which attack-related information has been added by the attack-related information addition unit 11, to generate time series data. Examples of items to be counted in this case include the attack-related information mentioned above, the destination port number of the traffic that was the source of the data to be analyzed, and the benign / malicious judgment result of the IDS inspection. Note that two or more of the above-mentioned items to be counted may be combined to define a new item to be counted (for example, a combination of the attack type and the product targeted by the attack), and data may be counted for each of the new items to be counted.

[0025] The detection unit 13 performs a time series analysis on the aggregated time series data, and when the number of observations of the data to be analyzed satisfies a predetermined condition, it determines that the time when the condition is met is the time when the attack was determined, and outputs this fact in a predetermined format. Specifically, the detection unit 13 estimates the number of observations of the analysis target data in the time period to be detected using an autoregressive integrated moving average (ARIMA) model based on the aggregated data for a predetermined period. As is known, the ARIMA model is a model obtained by combining a p-th order autoregressive (AR) model and a q-th order moving average (MA) model in a d-th order integration process. When selecting a combination of parameter values ​​p, d, and q for optimizing the ARIMA model, the detection unit 13 performs estimation using time series data for a predetermined period for all combinations of parameters. Then, for example, a parameter combination with the lowest Akaike Information Criterion (AIC) of the estimated result is searched for.

[0026] The detection unit 13 judges whether there is a change in the number of analysis target data observed during the detection target period based on the estimated value of the detection target period calculated by the generated ARIMA model. For example, the detection unit 13 can be configured to set the upper limit of a 100(1-α)% confidence interval (e.g., a 95% confidence interval) of the observation count estimate by the ARIMA model as the threshold for the judgment. FIG. 4 illustrates an overview of such an attack detection judgment. The detection unit 13 judges that the time when the observation count of the analysis target data exceeds the threshold set as described above, for example, is the time when an attack is detected. Then, the detection unit 13 outputs the tabulation item of the tabulated data and the time zone to which the detection time belongs.

[0027] Next, the overall operation of the attack detection device 1 according to this embodiment having the above-described configuration will be described with reference to Fig. 5. Fig. 5 is a flowchart illustrating the overall operation of the attack detection device 1. The attack detection device 1 executes the data processing illustrated in Fig. 5 at a predetermined time interval (for example, every hour). Alternatively, the attack detection device 1 may execute the data processing illustrated in Fig. 5 in response to receiving data to be analyzed.

[0028] When the attack detection device 1 starts processing, in step S10, the attack-related information assigning unit 11 acquires data to be analyzed. Next, in step S20, the attack-related information assigning unit 11 assigns attack-related information to the acquired data to be analyzed. As described with reference to FIG. 2, the content of the attack-related information assigning process in step S20 differs depending on the configuration of the attack-related information assigning unit 11.

[0029] When the attack-related information assigning unit 11 includes the IDS 120, the attack-related information assigning unit 11 acquires traffic data circulating on the network and attracted by honeypots, etc., and analyzes the data using the IDS it includes. The attack-related information assigning unit 11 assigns attack-related information to the analysis results of the IDS and outputs the results to the aggregation unit 12. On the other hand, when the attack-related information adding unit 11 receives monitoring log data from another monitoring device as data to be analyzed, the attack-related information adding unit 11 adds attack-related information to the monitoring log data of the received monitoring device and outputs it to the aggregation unit 12.

[0030] In step S30, the counting unit 12 counts the number of observations of the analysis target data for each predetermined item of the attack-related information, and stores the counted number of observations as time-series data in the storage unit 20. Next, in step S40, the counting unit 12 performs a time-series analysis on the time-series data for a predetermined period (e.g., the most recent two weeks) stored in the storage unit 20, and calculates an estimate of the time-series data up to the analysis target period (e.g., one week after the analysis time). As described above, for example, an ARIMA model is used to calculate this estimate. In addition, in step S40, the detection unit 13 generates a judgment threshold value for detecting a change in the time-series trend described later from the estimate of the time-series data.

[0031] Next, in step S50, the detection unit 13 compares the time series data of the most recent period (e.g., the past hour) with a threshold based on the estimated value of the time series data, and determines whether the time series trend has changed. If it is determined that the time series trend has not changed (S50: NO), the detection unit 13 ends the process as it is. In step S50, if the detection unit 13 determines that the time series data of the most recent period exceeds the determination threshold and the time series trend has changed (S50: YES), the detection unit 13 outputs the time series data on which the determination was based and the attack-related information attached thereto as attack occurrence information, and ends the process. The output destination of the attack occurrence information can be, for example, an output device such as a monitor display provided in the attack detection device 1, but there is no particular restriction and it may be determined appropriately.

[0032] As described above, the attack detection device 1 according to this embodiment can detect various attacks occurring on a network at an early stage. In addition, since attack-related information related to the detected attack is also output, the attributes of the detected attack can also be known.

[0033] [Embodiment 2] Next, an attack detection device 1 according to another embodiment will be described as a variation of the attack detection device 1 according to the above embodiment 1. The same reference numerals are used for components that are the same as or equivalent to those in embodiment 1. FIG. 6 shows an example of the configuration of the attack detection device 1 according to this embodiment. The attack detection device 1 according to this embodiment illustrated in Fig. 6 differs from the attack detection device 1 according to embodiment 1 (Fig. 1) in that a seriousness estimation unit 14 is provided in the control unit 10 and a correspondence table 21 is stored in the storage unit 20. The differences from embodiment 1 will be described below.

[0034] When the detection unit 13 determines that it has detected a sign of an attack and outputs attack occurrence information, the seriousness estimation unit 14 has the function of acquiring this attack occurrence information, searching the vulnerability information and correspondence table 21 described below, and evaluating and outputting the severity of the impact that the detected attack is expected to have on the target of the attack. Specifically, the severity estimation unit 14 searches for vulnerability information published on the network using the tabulation items included in the attack occurrence information acquired from the detection unit 13 as keys, and checks whether there is any vulnerability information related to the attack occurrence information. For example, published Common Vulnerabilities and Exposures (CVE) can be used as the vulnerability information.

[0035] Vulnerability information searches can be performed according to the aggregation item. For example, if the aggregation item is the product targeted by the attack and the identifier of the vulnerability of the target, a search is performed for vulnerability information that affects that product and vulnerability information that matches that vulnerability. If the aggregation item is the protocol targeted by the attack (application layer) and the destination port number of the traffic, Table 21 (described below) is searched to obtain product information that corresponds to that protocol and the identifier of the vulnerability related to that product information, and vulnerability information is searched based on that product information and the identifier of the vulnerability. If the aggregation item is the protocol targeted by the attack (transport layer), a full-text search is performed for vulnerability information to obtain vulnerability information that lists the name of the protocol.

[0036] Furthermore, the severity estimation unit 14 searches the correspondence table 21 based on the attack occurrence information. An example of the configuration of the correspondence table 21 is shown in FIG. 7. As shown in FIG. 7, the correspondence table 21 is a table in which an application protocol, a port number that is opened when the application is made public, a product used, and a vulnerability identifier related to the product are stored in association with each other. As an example of implementing the correspondence table 21, a method of creating the correspondence table based on information obtained from Shodan (https: / / www.shodan.io / ), which is an Internet search service, can be considered. By using the search function of Shodan, it is possible to obtain the port number corresponding to the application protocol, the product, and further the vulnerability identifier related to the product.

[0037] If the corresponding vulnerability information is found, the severity of the vulnerability is generated and output together with the vulnerability information. As an example of the severity to be output, text indicating that an attack related to the vulnerability has been observed (for example, "An attack targeting the SMB protocol has been observed") may be output together with the information of the aggregation item included in the attack occurrence information. Also, for example, the current value of the current status evaluation criterion in CVSSv3 (see, for example, https: / / www.ipa.go.jp / security / vuln / CVSSv3.html) may be calculated taking into account the presence or absence of observation of related attacks, and the value may be output as the severity. As a method of taking into account the presence or absence of observation of attacks, for example, the current status evaluation criterion value may be calculated by setting the evaluation result of the evaluation item "likelihood of attack (E)" to "easily attackable (H)".

[0038] Next, the overall operation of the attack detection device 1 according to the present embodiment, which has the above-described configuration, will be described with reference to Fig. 8. Fig. 8 is a flowchart illustrating the overall operation of the attack detection device 1 of the present embodiment. In the following description, the same processing as that in the flowchart of Fig. 5 relating to the first embodiment will not be described.

[0039] When the attack detection device 1 of this embodiment starts processing in the same manner as in the first embodiment, it executes the same processing as in the first embodiment from step S10 to step S50. If it is determined in step S50 that there is a change in the time series trend of the time series data in the analysis target period (S50: YES), the attack detection device 1 searches for vulnerability information and the correspondence table 21 using the time series data on which the determination was based and the attack related information in step S60. If it is determined that there is corresponding vulnerability information (S60: YES), the detection unit 13 determines the severity extracted based on the corresponding attack related information in step S70. Next, the detection unit 13 outputs the vulnerability information extracted based on the time series data in which it is determined that the time series trend has changed and its related information together with the severity calculated in step S70, and ends the processing. On the other hand, if it is determined in step S60 that there is no corresponding vulnerability information (S60: NO), the detection unit 13 outputs the obtained attack occurrence information and ends the processing, as in the first embodiment. The destination of the information may be considered to be the same as in the first embodiment.

[0040] An example of the output of the severity estimation unit 14 is shown in Fig. 9. Fig. 9 shows an example of a display screen in which, for example, a web page is generated by the severity estimation unit 14 based on the vulnerabilities and their severity searched or calculated, and displayed on an appropriate output terminal via the Internet. Fig. 9 includes items of protocol (application layer), destination port number, product name, vulnerability identifier, and text indicating severity as an example of output from the severity estimation unit 14, but is not limited to these items and may also include the current value of the current status evaluation criterion in CVSSv3 described above. The display screen of Fig. 9 may be displayed on an output device such as a monitor display of the attack detection device 1.

[0041] As described above, the attack detection device 1 according to this embodiment, like the first embodiment, can detect attacks occurring on a network at an early stage. In addition, since attack-related information related to the detected attack is also output, the attributes of the detected attack can also be known. Furthermore, the attack detection device 1 according to this embodiment not only detects attacks at an early stage, but also outputs objective evaluation information regarding what vulnerability the detected attack is related to and the severity of the vulnerability, so that the user can accurately grasp what measures should be taken against the detected attack depending on the vulnerability related to the detected attack and its severity.

[0042] In the attack detection device 1, the detection unit may calculate an estimate of the time series data for the period to be analyzed based on the time series data recorded during a specified period, and determine whether there is a change in the time series trend using a threshold value set based on the estimate. In this way, the time point at which a change in the time series trend occurs can be detected as the time point at which a sign of an attack was observed early and with high accuracy.

[0043] The attack detection device 1 may be configured to search for vulnerability information indicating vulnerabilities related to attacks on a network based on the attack-related information output from the detection unit, and if it is determined that there is vulnerability information related to the attack-related information, to output the vulnerability information. In this way, the severity of the vulnerability can be objectively evaluated taking into account the occurrence of attacks related to the vulnerability.

[0044] The attack detection device 1 may retain severity information associated with the vulnerability information, which is information indicating the severity of the vulnerability information, and the severity estimation unit may output the severity information associated with the searched vulnerability information. In this way, it is possible to objectively evaluate not only the vulnerability of a detected attack but also the severity of that vulnerability.

[0045] The severity information may be a current value calculated based on the attack-related information and based on a current assessment criterion of the Common Vulnerability Scoring System. In this way, the user can objectively evaluate the impact of the vulnerability based on the severity information, and can use this information to determine the priority of responses, etc.

[0046] The data to be analyzed may include traffic data acquired from a network, or a monitoring data log output from a monitoring device on the network. In this way, traffic data attracted to the honeypot can be obtained and directly analyzed, or the output of other monitoring devices can be used to monitor network behavior.

[0047] In addition, the above-mentioned embodiment can, for example, improve the security of communications via a network, which can contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0048] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0049] The attack detection method by the attack detection device 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0050] 1. Attack detection device 10 Control section 11. Attack-related information provision section 12 Counting Unit 13 Detection unit 14 Severity Estimation Section 20 Memory section

Claims

1. an attack-related information adding unit configured to receive analysis target data for analyzing attacks performed on a network and add attack-related information, which is information related to attributes of the attack, to the analysis target data; a counting unit configured to count the number of observations for each predetermined item of the attack-related information for the analysis target data to which the attack-related information has been added, and record the counted number of observations as time-series data; a detection unit configured to perform a time series analysis on the time series data, and when it is determined that a predetermined change has occurred in the time series trend, to determine that the attack has occurred, and to output the time series data that caused the determination and attack-related information; a severity estimation unit configured to search for vulnerability information indicating vulnerability to attacks on the network based on the application protocol and the destination port number as the attack-related information output from the detection unit by referring to a correspondence table that has been created in advance by correlating application protocols and destination port numbers of traffic on the network with application product names and vulnerability identifiers, and to output the vulnerability information when it is determined that there is vulnerability information related to the attack-related information; An attack detection device comprising:

2. The attack detection device of claim 1 , wherein the detection unit calculates an estimate of the time series data for a period to be analyzed based on the time series data recorded during a specified period, and determines whether there is a change in the time series trend using a threshold value set based on the estimate.

3. The attack detection device of claim 1, further comprising: severity information associated with the vulnerability information, the severity information being information indicating the severity of the vulnerability information; and the severity estimation unit outputs severity information associated with the searched vulnerability information, the severity information including text indicating that an attack related to the vulnerability has been observed.

4. The attack detection device according to claim 3 , wherein the severity information is a current value calculated based on the attack-related information and based on a current assessment criterion of the Common Vulnerability Scoring System.

5. The attack detection device according to claim 1 , wherein the data to be analyzed includes traffic data acquired from a network, or a monitoring data log output from a monitoring device on the network.

6. An information processing device, receiving analysis target data for analyzing attacks carried out on a network, and adding attack-related information to the analysis target data, the attack-related information being information related to attributes of the attack; tallying the number of observations for each predetermined item of the attack-related information for the analysis target data to which the attack-related information has been added, and recording the totaled number of observations as time-series data; performing a time series analysis on the time series data, and when it is determined that a predetermined change has occurred in the time series trend, determining that the attack has occurred, and outputting the time series data that caused the determination and attack-related information; by referring to a correspondence table created in advance by associating application protocols and destination port numbers of traffic on the network with application product names and vulnerability identifiers, searching for vulnerability information indicating vulnerabilities to attacks on the network based on the application protocols and destination port numbers as the output attack-related information, and when it is determined that there is vulnerability information related to the attack-related information, outputting the vulnerability information; Attack detection methods.

7. 7. The attack detection method according to claim 6, wherein the information processing device calculates an estimate of the time series data for a period to be analyzed based on the time series data recorded during a specified period, and determines whether there is a change in the time series trend using a threshold value set based on the estimate.

8. The attack detection method described in claim 6, wherein the information processing device holds severity information associated with the vulnerability information, which is information indicating the severity of the vulnerability information, and outputs severity information associated with the searched vulnerability information, which includes text indicating that an attack related to the vulnerability has been observed.

9. The attack detection method according to claim 8 , wherein a current value according to a current assessment criterion of a Common Vulnerability Scoring System, which is calculated based on the attack-related information, is used as the severity information.

10. The attack detection method according to claim 6 , wherein the analysis target data includes traffic data acquired from a network, or a monitoring data log output from a monitoring device on the network.

11. In the information processing device, receiving analysis target data to be analyzed regarding attacks carried out on a network, and adding attack-related information to the analysis target data, the attack-related information being information related to attributes of the attack; tallying the number of observations of each predetermined item of the attack-related information for the analysis target data to which the attack-related information has been added, and recording the totaled number of observations as time-series data; performing a time series analysis on the time series data, and when it is determined that a predetermined change has occurred in the time series trend, determining that the attack has occurred, and outputting the time series data that caused the determination and attack-related information; An attack detection program which searches for vulnerability information indicating vulnerability to attacks on a network based on the application protocol and destination port number as the output attack-related information by referring to a correspondence table created in advance by correlating application protocols and destination port numbers of traffic on a network with application product names and vulnerability identifiers, and if it determines that there is vulnerability information related to the attack-related information, executes a process to output the vulnerability information.

Images