Information processing device, information processing program, and information processing method

Abstract

To enable workability to be improved by simplifying gasping of a communication pattern which a person in charge of managing and maintaining an IT infrastructure has to grasp.SOLUTION: According to the present application, an information processing device includes an extraction part for extracting a transmission source IP address information showing an IP address of a transmission source in a communication log, a transmission destination IP address information showing an IP address of a transmission destination in the communication log, a transmission destination port number information showing a port number of the transmission destination and protocol information showing a protocol type specified by a header part located just after an IP header included in a header area of a packet from the inside of object log information on the basis of an object log information about a communication log in an object apparatus and an object log format showing a description pattern of the object log information, and a generation part for generating first communication pattern information about a communication pattern performed between the transmission source and the transmission destination on the basis of the transmission source IP address information, the transmission destination IP address information, the transmission destination port number information, and the protocol information.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing program, and an information processing method. [Background technology]

[0002] Various techniques related to the operation and maintenance of IT infrastructure, which is the foundation of computer and network environments used in organizations such as companies, have been known. For example, a communication system including a communication control device and a communication processing device is known, in which the communication processing device includes an analysis unit that analyzes an input packet and extracts at least source information indicating a source of the packet, and a processing unit that executes processing in accordance with a rule corresponding to the analysis result, and the communication control device includes at least a control unit that sets in the processing unit a first rule that executes processing to transmit, to the communication control device, a packet and a notification indicating that the packet has been input, when the source information extracted from the input packet indicates an unknown source, an extraction unit that extracts the source information from the packet received along with the notification from the communication processing device, and a memory control unit that stores in a memory unit at least the source information and time information corresponding to the time when the source information was received. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-61219 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the above-mentioned conventional technologies only analyze packets, and therefore do not necessarily improve workability by simplifying the understanding of communication patterns that IT infrastructure operators and maintainers need to be aware of.

[0005] The present application aims to provide an information processing device, an information processing program, and an information processing method that can improve workability by simplifying the understanding of communication patterns that personnel who operate and maintain IT infrastructure need to be aware of. [Means for solving the problem]

[0006] The information processing device according to the present application includes an extraction unit that extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating a port number of the destination, and protocol information indicating a protocol type identified by a header portion located immediately after an IP header included in a header area of ​​a packet, based on target log information regarding a communication log of a target device and a target log format indicating a description pattern of the target log information; and a generation unit that generates first communication pattern information regarding a communication pattern performed between the source and the destination, based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information. [Effects of the Invention]

[0007] According to one aspect of the embodiment, workability can be improved by simplifying the understanding of communication patterns that personnel who operate and maintain IT infrastructure need to understand. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an overview of information processing according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of the information processing device according to the embodiment. [Figure 3] FIG. 3 is a flowchart illustrating an example of information processing by the information processing device according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a parameter file according to the embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of device list information according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a log format according to the embodiment. [Figure 7] FIG. 7 is a diagram for explaining the pre-processing according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of subnet list information according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a subnet mask table according to the embodiment. [Figure 10] FIG. 10 is a diagram showing an example of subnet list information to which a start IP address and an end IP address converted into consecutive values ​​according to the embodiment have been added. [Figure 11] FIG. 11 is a diagram illustrating an example of basic information according to the embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of communication pattern information according to the embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of communication matrix information between servers according to the embodiment. [Figure 14] FIG. 14 is a diagram illustrating an example of communication matrix information between a client and a server according to the embodiment. [Figure 15] FIG. 15 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the information processing device. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an information processing device, an information processing program, and an information processing method according to the present application (hereinafter referred to as "embodiments") will be described in detail with reference to the drawings. Note that the information processing device, the information processing program, and the information processing method according to the present application are not limited to these embodiments. Furthermore, the same components in the following embodiments will be denoted by the same reference numerals, and duplicated descriptions will be omitted.

[0010] (Embodiment) [1. Overview of Information Processing] First, an overview of information processing according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an overview of information processing according to an embodiment. Fig. 1 shows an example in which information processing according to an embodiment is executed by an information processing device 100. Fig. 1 also describes a case in which the information processing device 100 provides an analysis result regarding a communication pattern of a communication log of a target device, which is a target device, to a user who operates and maintains an IT infrastructure that is the foundation of a computer and network environment used by a predetermined organization (for example, a predetermined company).

[0011] Here, the target device is an information device. For example, the target device may be a network device such as a router, a switch, or a firewall. The target device is not limited to a network device, but may also be a server such as a Dynamic Host Configuration Protocol (DHCP) server, a proxy server, a Virtual Private Network (VPN) server, or a Domain Name System (DNS) server. A communication log for a target device refers to a record of communication of information transmitted from a sender to a destination via the target device. While the present application uses terms such as a DHCP server, a proxy server, a VPN server, or a DNS server, these devices are not limited to servers constructed using general-purpose servers and software, and may include appliance devices. Specifically, for example, a VPN server may be a combination of a general-purpose server and known software such as SoftEther VPN, OpenVPN, or WireGuard. The VPN server may also be an appliance product provided by various network vendors. The same applies to DHCP servers, proxy servers, and DNS servers.

[0012] First, the user's terminal device 10 transmits a parameter file related to extraction conditions for extracting communication logs of a target device to the information processing device 100. The information processing device 100 acquires the parameter file from the terminal device 10 (step S1). After acquiring the parameter file, the information processing device 100 transmits a transmission request for target log information related to the communication logs of the target device to the log server 200 (step S2). After receiving the transmission request for target log information from the information processing device 100, the log server 200 transmits the target log information to the information processing device 100. The information processing device 100 acquires the target log information from the log server 200 (step S3). After acquiring the target log information, the information processing device 100 generates an analysis result related to the communication pattern of the communication log of the target device based on the target log information (step S4). After generating the analysis result, the information processing device 100 provides the analysis result to the terminal device 10 (step S5).

[0013] 1, an information processing system 1 according to the embodiment includes a terminal device 10, an information processing device 100, and a log server 200. The terminal device 10, the information processing device 100, and the log server 200 are connected to each other via a network N (not shown) in a wired or wireless manner so as to be able to communicate with each other.

[0014] The terminal device 10 is an information processing device used by a user. The terminal device 10 may be, for example, an information processing device such as a smartphone, a tablet terminal, a desktop PC, a notebook PC, a mobile phone, or a PDA (Personal Digital Assistant). The terminal device 10 transmits a parameter file to the information processing device 100 via a network N.

[0015] The information processing device 100 may be, for example, a personal computer (PC), a workstation (WS), a computer with server functions, etc. The information processing device 100 performs processing based on a parameter file transmitted from the terminal device 10 via the network N, for example.

[0016] Log server 200 is a server device that stores log information related to communication logs for all information devices used in a specific organization. Log server 200 collectively manages log information related to communication logs stored in multiple servers provided at multiple bases (also referred to as sites) in a specific organization. Specifically, log server 200 stores log information for firewalls, DHCP servers, proxy servers, VPN servers, DNS servers, etc. For example, log server 200 stores log information in a specific file format for each piece of information such as the host name corresponding to the information device, the IP address corresponding to the information device, and the date and time when the communication log for the information device was generated. Hereinafter, a file containing log information may be referred to as a log file.

[0017] When storing log information, the log server 200 may compress the log files in any compression format, such as ZIP format, tape archives (TAR) format, or GZIP format. This allows the log files to be stored while reducing the amount of resources required by the log server 200. Note that a file obtained by compressing a log file may also be referred to as a compressed file.

[0018] The network N connects the terminal device 10, the information processing device 100, and the log server 200 to each other in a wired or wireless manner so that they can communicate with each other. If the network N is wired, it may be realized by ETHERNET (registered trademark) defined in IEEE802.3. If the network N is wireless, it may be realized by a wireless LAN (Local Area Network) defined in IEEE802.11.

[0019] 2. Configuration of Information Processing Device An example of the configuration of the information processing device 100 according to the embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the configuration of the information processing device 100 according to the embodiment. The information processing device 100 includes a communication unit 110, a storage unit 120, and a control unit 130.

[0020] (Communication unit 110) The communication unit 110 is realized by a NIC (Network Interface Card), an antenna, etc. The communication unit 110 is connected to various networks via wired or wireless connections, and transmits and receives information to and from the terminal device 10 and the log server 200, for example.

[0021] (Storage unit 120) The storage unit 120 is realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. Specifically, the storage unit 120 stores various data. For example, the storage unit 120 stores device list information, a log format, subnet list information, a subnet mask table, and subnet list information to which start IP addresses and end IP addresses converted into continuous values ​​have been added. The storage unit 120 also stores various programs. For example, the storage unit 120 stores an information processing program according to an embodiment.

[0022] (control unit 130) The control unit 130 is a controller, and is realized, for example, by a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) executing various programs stored in a storage device inside the information processing device 100 using RAM as a work area. The control unit 130 is also a controller, and is realized, for example, by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0023] The control unit 130 has an acquisition unit 131, an extraction unit 132, an identification unit 133, a generation unit 134, and a provision unit 135 as functional units, and may realize or execute the information processing actions described below. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 2, and may be any other configuration that performs the information processing described below. Furthermore, each functional unit indicates a function of the control unit 130, and does not necessarily have to be physically distinct.

[0024] (Acquisition part 131) The acquisition unit 131 acquires various types of information. Specifically, the acquisition unit 131 acquires a parameter file from the terminal device 10. Furthermore, when the acquisition unit 131 acquires the parameter file, the acquisition unit 131 transmits a transmission request for target log information related to the communication log of the target device to the log server 200. Furthermore, the acquisition unit 131 acquires the target log information from the log server 200.

[0025] (Extraction part 132) The extraction unit 132 extracts various information. Specifically, based on the target log information related to the communication log of the target device acquired by the acquisition unit 131 and a target log format indicating a description pattern of the target log information, the extraction unit 132 extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating a protocol type (e.g., Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), etc.) identified by a header portion located immediately after an IP header included in a header area of ​​a packet transmitted and received between information devices via the network N. In this disclosure, for convenience of explanation, the above protocols may be referred to as protocols in the transport layer. Here, the transport layer refers to layer 4 in the OSI reference model and layer 3 in the TCP / IP model, which is a layer that provides communication management functions in a network. The Internet Control Message Protocol (ICMP) and ICMP for IPv6 (ICMPv6) are generally considered to be protocols belonging to the network layer in the OSI reference model and the internet layer in the TCP / IP model, but since they are higher-level protocols than the Internet Protocol (IP) and may be processed in firewall devices and the like in the same way as transport layer protocols, in this disclosure they will be described as being included in the transport layer protocols.

[0026] (Specific Section 133) The identification unit 133 identifies various information. Specifically, the identification unit 133 calculates start IP address information indicating a start IP address with the smallest numerical value among the multiple IP addresses included in each of the multiple subnet addresses, and end IP address information indicating an end IP address with the largest numerical value included in the IP address. Next, the identification unit 133 identifies target subnet address information indicating a target subnet address corresponding to the target IP address based on whether the target IP address exists among the IP addresses between the start IP address and the end IP address. For example, the identification unit 133 identifies source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address.

[0027] (Generation unit 134) The generation unit 134 generates various types of information. Specifically, the generation unit 134 generates an analysis result regarding the communication pattern of the communication log in the target device based on the target log information acquired by the acquisition unit 131. More specifically, the generation unit 134 generates basic information regarding the communication pattern performed between the source and destination based on the source IP address information, destination IP address information, destination port number information, and protocol information extracted by the extraction unit 132.

[0028] (Provider 135) The providing unit 135 provides various types of information. Specifically, the providing unit 135 provides the analysis result generated by the generating unit 134 to the terminal device 10. More specifically, the providing unit 135 transmits the analysis result to the terminal device 10. For example, the providing unit 135 transmits first communication pattern information to the terminal device 10 as an example of the analysis result.

[0029] Next, an example of information processing by the information processing device 100 according to the embodiment will be described with reference to Fig. 3. Fig. 3 is a flowchart showing an example of information processing by the information processing device according to the embodiment. In Fig. 3, the acquisition unit 131 acquires a parameter file from the terminal device 10 (step S101). The parameter file is information including an IP address and a host name corresponding to a target device.

[0030] An example of the parameter file 121 according to the embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the parameter file 121 according to the embodiment. In the example shown in Fig. 4, the parameter file 121 includes information on items such as "IP address," "log format identification information," "host name," "target date From," and "target date To."

[0031] The parameter file may be a data file in a Comma Separated Values ​​(CSV) format, a Tab Separated Values ​​(TSV) format, etc. The parameter file may also be binary data in a text format, a JavaScript (registered trademark) Object Notation (JSON) format, etc.

[0032] "IP address" indicates the IP address corresponding to the target device. "Log format identification information" indicates identification information that identifies the target log format, which indicates the description pattern of the communication log of the target device. Specifically, for example, the log format identification information may be information that indicates the type of target device, such as a router, firewall, DNS server, or proxy server. Even devices of the same type may output different log formats depending on factors such as the manufacturer, system version, or configuration. Also, different types of devices may use a common log format depending on factors such as the manufacturer, system version, or configuration. Therefore, for example, the log format identification information may be information that identifies devices with the same log format. "Host name" indicates the host name corresponding to the target device. "Target date From" indicates the start date of the period in which the log to be analyzed was generated. "Target date To" indicates the end date of the period in which the log to be analyzed was generated.

[0033] Furthermore, when the acquisition unit 131 acquires the parameter file, it acquires device list information by referring to the storage unit 120. The device list information is information that associates the IP addresses, host names, information indicating the storage locations of communication logs, and log format identification information corresponding to all information devices used in a specific organization.

[0034] An example of the device list information 122 according to the embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the device list information 122 according to the embodiment. In the example shown in Fig. 5, the device list information 122 includes information on items such as "IP address," "device identification information," "host name," "log storage path," and "log format identification information."

[0035] "IP address" indicates the IP address corresponding to each of all information devices used in a specified organization. "Device identification information" indicates identification information for identifying the type of device corresponding to each of all information devices used in a specified organization. "Host name" indicates the host name corresponding to each of all information devices used in a specified organization. "Log storage path" indicates the storage location of log information related to communication logs in each of all information devices used in a specified organization. Specifically, "log storage path" indicates the storage location of log information in log server 200. Note that if multiple log servers 200 are installed, it may include information for identifying the log server 200 that stores the log information of the device. "Log format identification information" indicates identification information for identifying the log format that indicates the description pattern of communication logs in each of all information devices used in a specified organization.

[0036] Furthermore, when the acquiring unit 131 acquires the parameter file and the device list information, the acquiring unit 131 compares the IP address and host name corresponding to the target device included in the parameter file with the IP addresses and host names corresponding to all of the information devices included in the device list information to identify a storage location of the target log information related to the communication log of the target device. Furthermore, when the acquiring unit 131 identifies a storage location of the target log information, the acquiring unit 131 transmits a transmission request for the target log information stored in the identified storage location to the log server 200. Furthermore, the acquiring unit 131 acquires the target log information from the log server 200 (step S102). Specifically, the acquiring unit 131 acquires a log file including the target log information. For example, the acquiring unit 131 acquires the log file based on any file transfer protocol such as File Transfer Protocol (FTP), Secure FTP (SFTP), or Secure Copy Protocol (SCP). Furthermore, when the acquiring unit 131 acquires a compressed file as the log file, the acquiring unit 131 decompresses the compressed file to acquire the log file (step S103). Furthermore, the acquiring unit 131 acquires the target log information from the log file.

[0037] Furthermore, when acquiring target log information, the acquiring unit 131 refers to the storage unit 120 and acquires a log format indicating a description pattern of log information corresponding to each of a plurality of different information devices. The acquiring unit 131 acquires a plurality of different log formats corresponding to each of the plurality of different information devices. The log format is information that associates an extraction target indicating information to be extracted from a log corresponding to an information device with identification information that identifies the log format corresponding to the information device. When acquiring a plurality of different log formats, the acquiring unit 131 refers to the identification information that identifies each of the plurality of different log formats and the identification information that identifies the target log format included in the parameter file, and identifies a target log format that indicates the description pattern of the target log information from among the plurality of different log formats. When identifying the target log format, the acquiring unit 131 acquires the identified target log format from among the acquired plurality of different log formats.

[0038] Here, due to circumstances such as changes in the settings of information devices or software updates, logs in a certain format may be deleted or the format of an existing log may be changed. In this case, the log format may not be correctly recognized until the log format is corrected, hindering communication log analysis. However, for an administrator managing a huge number of information devices, it is difficult to immediately update the system for all of the managed information devices. Therefore, the acquisition unit 131 may notify the administrator if the target log information does not match any log format or if the frequency of occurrence of a specific log format has changed. Specifically, the acquisition unit 131 may record the number of times each log format is processed within a unit time (e.g., one day) and notify the administrator if the number of processing times increases or decreases by a predetermined percentage compared to the previous number of processing times. Furthermore, the acquisition unit 131 may notify the administrator if the target log information is zero, or if the target log information does not match any format.

[0039] An example of a log format according to an embodiment will be described with reference to FIG. 6. FIG. 6 is a diagram illustrating an example of a log format according to an embodiment. FIG. 6 illustrates a log format indicating a description pattern of log information corresponding to two types of firewalls (type 1) and (type 2) from different vendors, a log format indicating a description pattern of log information corresponding to DHCP, a log format indicating a description pattern of log information corresponding to a proxy, a log format indicating a description pattern of log information corresponding to a VPN, and a log format indicating a description pattern of log information corresponding to DNS. The extraction targets illustrated in FIG. 6 indicate information to be extracted from each log format. For example, the extraction targets are source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, and destination port number information indicating the port number of the destination. As illustrated in FIG. 6, the log formats of information devices are not uniform.

[0040] Furthermore, when the acquisition unit 131 acquires the target log information and the target log format, the extraction unit 132 extracts, from the target log information, information corresponding to the extraction target in the target log format, based on the target log format and the target log information acquired by the acquisition unit 131. Specifically, the extraction unit 132 extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, and destination port number information indicating the port number of the destination.

[0041] Furthermore, the acquisition unit 131 performs pre-processing based on the subnet list information and the subnet mask table (step S105). The subnet list information is a list of addresses (hereinafter, may be referred to as "subnet addresses") corresponding to all subnetworks used by a specific organization. The subnet mask table is a table that associates mask lengths, mask values, the number of IP addresses, and the result of dividing the number of IP addresses by 256.

[0042] FIG. 7 is a diagram illustrating a pre-processing according to an embodiment. In FIG. 7, the acquisition unit 131 acquires, for example, one subnet address indicated by "XX.X.120.0 / 22" from the subnet list information. The acquisition unit 131 identifies, as the start IP address, "XX.X.120.0," which has the smallest numerical value among 256 IP addresses included in the subnet corresponding to "XX.X.120.0" before "22," which indicates the mask length, in the acquired subnet address "XX.X.120.0 / 22." When the acquisition unit 131 identifies "XX.X.120.0" as the start IP address, it converts "XX.X.120.0" to the consecutive value "XXXXXX120000." Specifically, the acquisition unit 131 converts the numbers separated by periods (hereinafter, each number will be referred to as an "octet"), "XX," "X," "120," and "0," respectively, into three-digit numbers, "XXX," "XXX," "120," and "000," respectively, in "XX.X.120.0," and then generates the continuous value "XXXXXX120000" excluding the periods.

[0043] Furthermore, the acquisition unit 131 refers to the subnet mask table and acquires the mask value "255.255.252.0" corresponding to the mask length "22" of the acquired subnet address, the number of IP addresses "1024," and the value "4" obtained by dividing the number of IP addresses by 256. Since the value of the third octet of the mask value "255.255.252.0" is "252" which is less than "255," the acquisition unit 131 identifies the third octet of the acquired subnet address as the target octet. Furthermore, when the acquisition unit 131 identifies the third octet as the target octet, it counts up the target octet based on the value "4" obtained by dividing the number of IP addresses by 256. Specifically, the acquisition unit 131 calculates "XX.X.120.0," "XX.X.121.0," "XX.X.122.0," and "XX.X.123.0," which are obtained by increasing the value of the third octet by "4" including "XX.X.120.0" identified as the start IP address. Furthermore, the acquisition unit 131 identifies "XX.X.123.255," which has the largest numerical value included in the IP address, as the end IP address out of 256 IP addresses included in the subnet corresponding to "XX.X.123.0," which has the largest third octet value among "XX.X.120.0," "XX.X.121.0," "XX.X.122.0," and "XX.X.123.0." When the acquisition unit 131 identifies "XX.X.123.255" as the end IP address, it converts "XX.X.123.255" into the consecutive value "XXXXXX123255." Specifically, the acquisition unit 131 converts the numbers "XX," "X," "123," and "255" separated by "." in "XX.X.123.255" into three-digit numbers "XXX," "XXX," "123," and "255," respectively, and then generates the consecutive value "XXXXXX123255" with the "." removed.

[0044] In this way, for each of all subnet addresses included in the subnet list information, the acquisition unit 131 calculates a start IP address having the smallest numerical value included in the IP address and an end IP address having the largest numerical value included in the IP address among multiple IP addresses included in the subnetwork corresponding to the subnet address. Furthermore, when the acquisition unit 131 calculates the start IP address and the end IP address, it generates start IP address information (corresponding to the start IP address converted into the continuous value described above) indicating the start IP address and end IP address information (corresponding to the end IP address converted into the continuous value described above) indicating the end IP address. Furthermore, when the acquisition unit 131 generates the start IP address information (corresponding to the start IP address converted into the continuous value described above) and the end IP address information (corresponding to the end IP address converted into the continuous value described above), it generates subnet list information by adding the start IP address information (corresponding to the start IP address converted into the continuous value described above) and the end IP address information (corresponding to the end IP address converted into the continuous value described above) to the subnet list information.

[0045] An example of subnet list information 123 according to the embodiment will be described with reference to Fig. 8. Fig. 8 is a diagram showing an example of subnet list information 123 according to the embodiment. In the example shown in Fig. 8, subnet list information 123 includes information on items such as "network address," "bit mask," "subnet," "category ID," and "category."

[0046] "Network address" indicates the address corresponding to the network part of the subnet address. "Bit mask" indicates the mask length of the subnet. "Subnet" indicates the address corresponding to the subnetwork (also called the subnet address). "Category ID" indicates identification information that identifies the category of the subnetwork. "Category" indicates the category of the subnetwork.

[0047] In this embodiment, a category refers to category information (tag-like information) indicating a category previously associated with a sub-network by a user who operates and maintains the IT infrastructure. Specifically, the category information may be information indicating the use of the sub-network. For example, the category information may be information indicating that the use corresponds to a cloud database, information indicating that the use corresponds to management, etc.

[0048] An example of the subnet mask table 124 according to the embodiment will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the subnet mask table 124 according to the embodiment. In the example shown in Fig. 9, the subnet mask table 124 includes information on items such as "mask length," "mask value," "number of IPs," and "result of division by 256."

[0049] "Mask length" indicates the mask length of the subnet mask. "Mask value" indicates the mask value of the subnet mask. "Number of IPs" indicates the number of IP addresses included in the subnetwork corresponding to the subnet mask. "Result of division by 256" indicates the number of IP addresses included in the subnetwork corresponding to the subnet mask divided by 256.

[0050] An example of subnet list information 125 to which start IP addresses and end IP addresses converted into consecutive values ​​according to the embodiment have been added will be described using FIG. 10. FIG. 10 is a diagram showing an example of subnet list information 125 to which start IP addresses and end IP addresses converted into consecutive values ​​according to the embodiment have been added. The subnet list information 125 shown in FIG. 10 is obtained by adding information items such as "start IP address" and "end IP address" to the subnet list information 123 shown in FIG. 8. The "start IP address" indicates the value obtained by converting the start IP address in the subnetwork corresponding to the subnet address into a consecutive value. The "end IP address" indicates the value obtained by converting the end IP address in the subnetwork corresponding to the subnet address into a consecutive value.

[0051] Furthermore, when the extraction unit 132 extracts the source IP address information, the destination IP address information, and the destination port number information, the identification unit 133 identifies the source subnet address information indicating the subnet address corresponding to the source IP address and the destination subnet address information indicating the subnet address corresponding to the destination IP address (step S106). Specifically, the identification unit 133 converts the source IP address into a continuous value based on the source IP address information. When the identification unit 133 converts the source IP address into a continuous value, the identification unit 133 references the subnet list information 125 to which the start IP address and the end IP address converted into continuous values ​​have been added, and determines whether the source IP address is within a range of IP addresses between a start IP address and an end IP address corresponding to each of the multiple subnet addresses. When the identification unit 133 determines that the source IP address is within a range of IP addresses between the start IP address and the end IP address, the identification unit 133 identifies the subnet address being the subject of the determination as the source subnet address, which is the subnet address corresponding to the source IP address. Similarly, when the destination IP address is converted into a continuous value, the identifying unit 133 refers to the subnetwork list information 125 to which the start IP address and end IP address converted into continuous values ​​have been added, and determines whether the destination IP address is within the range of the IP address between the start IP address and end IP address corresponding to each of the multiple subnetwork addresses. When the identifying unit 133 determines that the destination IP address is within the range of the IP address between the start IP address and end IP address, it identifies the subnetwork address being the subject of the determination as the destination subnetwork address, which is the subnetwork address corresponding to the destination IP address.

[0052] Furthermore, based on the source IP address information, destination IP address information, destination port number information, and protocol information extracted by the extraction unit 132, the generation unit 134 generates basic information including the source IP address information, destination IP address information, destination port number information, and protocol information extracted by the extraction unit 132. The generation unit 134 also generates basic information regarding the communication pattern between the source and destination. Specifically, the generation unit 134 generates basic information including the number of communications performed between the source and destination. That is, the generation unit 134 generates communication pattern information including the number of communications performed between the source information device and the destination information device. Based on the source subnetwork address information and destination subnetwork address information identified by the identification unit 133, the generation unit 134 also generates basic information including the source subnetwork address information and destination subnetwork address information identified by the identification unit 133 (step S107). The generation unit 134 also generates basic information including source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork.

[0053] An example of the basic information 126 according to the embodiment will be described with reference to Fig. 11. Fig. 11 is a diagram showing an example of the basic information 126 according to the embodiment. In the example shown in Fig. 11, the basic information 126 includes information on items such as "protocol," "source IP address," "source network address," "source bit mask," "source category," "destination IP address," "destination network address," "destination bit mask," "destination category," "destination port number," and "number of items."

[0054] "Protocol" indicates the communication protocol. "Source IP address" indicates the IP address of the sender. "Source network address" indicates the subnet address corresponding to the source IP address (hereinafter may be referred to as "source subnet address"). "Source bit mask" indicates the mask length of the subnet mask corresponding to the source subnet address. "Source category" indicates the category of the sender. "Destination IP address" indicates the IP address of the destination. "Destination network address" indicates the subnet address corresponding to the destination IP address (hereinafter may be referred to as "destination subnet address"). "Destination bit mask" indicates the mask length of the subnet mask corresponding to the destination subnet address. "Destination category" indicates the category of the destination. "Destination port number" indicates the port number of the destination. "Number of events" indicates the number (number of times) of communications conducted between the source information device and the destination information device. Specifically, "number of events" indicates the number of communications contained in the log generated between the "Target date From" and the "Target date To" included in the parameter file 121.

[0055] Furthermore, the generation unit 134 generates communication pattern information relating to the communication pattern for each subnet address between the source subnetwork and the destination subnetwork, based on the basic information. Specifically, the generation unit 134 generates communication pattern information including the number of communications for each subnet address between the source subnetwork and the destination subnetwork, based on the source subnetwork address information and the destination subnetwork address information included in the basic information. That is, the generation unit 134 generates communication pattern information including the number of communications performed between the source subnetwork and the destination subnetwork.

[0056] An example of the communication pattern information 127 according to the embodiment will be described with reference to Fig. 12. Fig. 12 is a diagram illustrating an example of the communication pattern information 127 according to the embodiment. In the example shown in Fig. 12, the communication pattern information 127 includes information on items such as "source segment," "source bit mask," "destination segment," "destination bit mask," "destination port number," and "number of items."

[0057] "Source segment" indicates the source subnetwork. Specifically, "source segment" is the source subnetwork address. "Source bit mask" indicates the mask length of the subnet mask corresponding to the source subnetwork address. "Destination segment" indicates the destination subnetwork. Specifically, "destination segment" is the destination subnetwork address. "Destination bit mask" indicates the mask length of the subnetwork corresponding to the destination subnetwork address. "Destination port number" indicates the destination port number. "Number of occurrences" indicates the number of communications that took place between the source subnetwork and the destination subnetwork.

[0058] Furthermore, when generating the basic information, the generation unit 134 generates matrix information relating to the communication pattern for each category performed between the source subnetwork and the destination subnetwork based on the basic information. Specifically, the generation unit 134 generates inter-server communication matrix information relating to the communication pattern for each category performed between the subnetwork to which the source server belongs and the subnetwork to which the destination server belongs. More specifically, the generation unit 134 generates inter-server communication matrix information including information based on the number of communications for each category performed between the subnetwork to which the source server belongs and the subnetwork to which the destination server belongs, based on the source IP address information and source category information and the destination IP address information and destination category information included in the basic information.

[0059] An example of the inter-server communication matrix information 128 according to the embodiment will be described with reference to FIG. 13. FIG. 13 is a diagram illustrating an example of the inter-server communication matrix information 128 according to the embodiment. Although not shown in FIG. 13, the generation unit 134 displays the number of communications performed between the subnetwork to which the source server belongs and the subnetwork to which the destination server belongs in each cell of the inter-server communication matrix information 128. Furthermore, the generation unit 134 visually highlights and displays cells in which communication between subnetworks that are not permitted as a communication pattern has occurred. For example, the generation unit 134 displays cells in which communication between subnetworks that are not permitted as a communication pattern has occurred by filling them in red.

[0060] 13, the inter-server communication matrix information 128 includes information on major categories such as "Source" and "Destination." Furthermore, "Source" and "Destination" further include information on medium categories such as "Group Name" and "Category Name." Furthermore, "Group Name" and "Category Name" further include information on minor categories such as "Development," "Internal," "DMZ," "Shared," and "Internet."

[0061] "Source" indicates the source of transmission. "Destination" indicates the destination of transmission. "Group name" indicates the name of the group corresponding to the subnetwork to which the source server or destination server belongs. "Category name" indicates the name of the category corresponding to the subnetwork to which the source server or destination server belongs. "Development" indicates the subnetwork to which servers used for system development belong. "Internal" indicates the subnetwork to which servers that can only connect to networks within an organization belong. "Demilitarized Zone (DMZ)" indicates the subnetwork to which DMZ servers belong. "Shared" indicates the subnetwork to which servers that can connect to a shared network within an organization belong. "Internet" indicates the subnetwork to which servers that can connect to the Internet belong.

[0062] Furthermore, the generation unit 134 generates client-server communication matrix information relating to the communication pattern for each category performed between the sub-network to which the source client belongs and the sub-network to which the destination server belongs. More specifically, the generation unit 134 generates client-server communication matrix information including information based on the number of communications for each category performed between the source client and the destination server, based on the source IP address information and source category information and the destination IP address information and destination category information included in the basic information.

[0063] An example of the client-server communication matrix information 129 according to the embodiment will be described with reference to FIG. 14. FIG. 14 is a diagram illustrating an example of the client-server communication matrix information 129 according to the embodiment. Although not shown in FIG. 14, the generation unit 134 displays the number of communications performed between the subnetwork to which the source client belongs and the subnetwork to which the destination server belongs in each cell of the client-server communication matrix information 129. Furthermore, the generation unit 134 visually highlights and displays cells in which communication between subnetworks that are not permitted as a communication pattern has occurred. For example, the generation unit 134 displays cells in which communication between subnetworks that are not permitted as a communication pattern has occurred by filling them in red.

[0064] In the example shown in Figure 14, client-server communication matrix information 129 includes information on major categories such as "Source" and "Destination." Furthermore, "Source" and "Destination" each include information on medium categories such as "Group Name" and "Category Name." Furthermore, the "Group Name" and "Category Name" corresponding to "Source" each include information on minor categories such as "Development Terminal," "Normal Terminal," "High Security Terminal," and "External Terminal." Furthermore, the "Group Name" and "Category Name" corresponding to "Destination" each include information on minor categories such as "Development," "Internal," "DMZ," "Shared," and "Internet."

[0065] "Source" indicates the source of the data. The "group name" corresponding to "Source" indicates the name of the group corresponding to the source client. The "category name" corresponding to "Source" indicates the name of the category corresponding to the source client. "Development terminal" indicates a terminal used for development. "Normal terminal" indicates a normal terminal. "High security terminal" indicates a terminal with high security. "External terminal" indicates a terminal outside the company. "Destination" indicates the destination of the data. The "group name" corresponding to "Destination" indicates the name of the group corresponding to the destination server. The "category name" corresponding to "Source" indicates the name of the category corresponding to the destination server. "Development" indicates a server used for system development. "Internal" indicates a server that can only be connected to the organization's internal network. "DMZ" indicates a server for use in the DMZ. "Shared" indicates a server that can be connected to a shared network within the organization. "Internet" indicates a server that can be connected to the Internet.

[0066] [3. Effects] As described above, the information processing apparatus 100 according to the embodiment includes an extraction unit 132 and a generation unit 134. Based on target log information related to a communication log of a target device and a target log format indicating a description pattern of the target log information, the extraction unit 132 extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating the protocol type identified by the header portion located immediately after the IP header included in the header area of ​​the packet. Based on the source IP address information, destination IP address information, destination port number information, and protocol information, the generation unit 134 generates first communication pattern information related to the communication pattern performed between the source and destination.

[0067] This enables the information processing device 100 to analyze communication logs from a variety of information devices more quickly and flexibly. Therefore, the information processing device 100 can improve work efficiency by simplifying the understanding of communication patterns that IT infrastructure operators and maintenance personnel need to understand. Furthermore, the information processing device 100 can easily identify the scope of impact of configuration changes and other operations in the operation and maintenance of IT infrastructure, thereby contributing to the achievement of Sustainable Development Goal (SDG) Goal 9, "Build resilient infrastructure, promote inclusive and sustainable industrialization, promote innovation and inclusive governance," and SDG Goal 12, "Responsible Consumption and Production."

[0068] The information processing device 100 further includes an identification unit 133. The identification unit 133 calculates start IP address information indicating a start IP address with the smallest numerical value among the multiple IP addresses included in each of the multiple subnet addresses, and end IP address information indicating an end IP address with the largest numerical value included in the IP address, and identifies target subnet address information indicating a target subnet address corresponding to the target IP address based on whether the target IP address is present among the IP addresses between the start IP address and the end IP address. The identification unit 133 also identifies source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address. The generation unit 134 generates first communication pattern information including the source subnet address information and the destination subnet address information.

[0069] This allows the information processing apparatus 100 to improve the convenience when defining a policy for each subnet, for example.

[0070] Furthermore, the generating unit 134 generates second communication pattern information relating to a communication pattern for each subnet address performed between the source subnetwork and the destination subnetwork, based on the first communication pattern information.

[0071] This allows the information processing device 100 to improve the convenience when defining a policy for each subnet.

[0072] Furthermore, the generation unit 134 generates first communication pattern information including source category information indicating a category corresponding to a source subnetwork and destination category information indicating a category corresponding to a destination subnetwork, and generates third communication pattern information regarding a category-based communication pattern performed between the source subnetwork and the destination subnetwork based on the generated first communication pattern information.

[0073] This allows the information processing device 100 to close the port when, for example, communication between sub-networks that is not permitted as a communication pattern occurs.

[0074] Furthermore, the generation unit 134 generates third communication pattern information regarding a communication pattern for each category performed between the sub-network to which the source server belongs and the sub-network to which the destination server belongs.

[0075] This allows the information processing device 100 to close the port when, for example, communication between sub-networks that is not permitted as a communication pattern occurs.

[0076] Furthermore, the generating unit 134 generates third communication pattern information relating to a communication pattern for each category performed between the sub-network to which the source client belongs and the sub-network to which the destination server belongs.

[0077] This allows the information processing device 100 to close the port when, for example, communication between sub-networks that is not permitted as a communication pattern occurs.

[0078] [4. Hardware Configuration] The information processing device 100 according to the embodiment described above is realized by, for example, a computer 1000 configured as shown in Fig. 15. Fig. 15 is a hardware configuration diagram showing an example of a computer that realizes the functions of the information processing device 100. The computer 1000 includes a CPU 1100, a RAM 1200, a ROM 1300, an HDD 1400, a communication interface (I / F) 1500, an input / output interface (I / F) 1600, and a media interface (I / F) 1700.

[0079] The CPU 1100 operates and controls each unit based on programs stored in the ROM 1300 or the HDD 1400. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 starts up, programs that depend on the hardware of the computer 1000, and the like.

[0080] The HDD 1400 stores programs executed by the CPU 1100, data used by such programs, etc. The communication interface 1500 receives data from other devices via a predetermined communication network and sends it to the CPU 1100, and transmits data generated by the CPU 1100 to other devices via the predetermined communication network.

[0081] The CPU 1100 controls output devices such as a display and a printer, and input devices such as a keyboard and a mouse, via the input / output interface 1600. The CPU 1100 acquires data from the input devices via the input / output interface 1600. The CPU 1100 also outputs generated data to the output devices via the input / output interface 1600.

[0082] Media interface 1700 reads a program or data stored in recording medium 1800 and provides it to CPU 1100 via RAM 1200. CPU 1100 loads the program or data from recording medium 1800 onto RAM 1200 via media interface 1700 and executes the loaded program. Recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory.

[0083] For example, when the computer 1000 functions as the information processing device 100 according to the embodiment, the CPU 1100 of the computer 1000 executes programs loaded onto the RAM 1200 to realize the functions of the control unit 130. The CPU 1100 of the computer 1000 reads and executes these programs from the recording medium 1800, but as another example, the CPU 1100 may obtain these programs from another device via a predetermined communication network.

[0084] Although some of the embodiments of the present application have been described in detail above with reference to the drawings, these are merely examples, and the present invention can be implemented in other forms that include the embodiments described in the Disclosure of the Invention section and that have undergone various modifications and improvements based on the knowledge of those skilled in the art.

[0085] [5. Other] Furthermore, among the processes described in the above embodiments and modifications, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

[0086] Furthermore, the components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

[0087] Furthermore, the above-described embodiments and modifications can be combined as appropriate within the scope of not causing any contradiction in the processing content. [Explanation of symbols]

[0088] 1. Information Processing Systems 10 Terminal Equipment 200 Log Server 100 Information processing device 110 Communications Department 120 Storage section 130 Control Unit 131 Acquisition Department 132 Extraction part 133 Specific part 134 Generation part 135 Provision Department

Claims

1. an extraction unit that extracts, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating a protocol type identified by a header portion located immediately after the IP header included in a header area of ​​a packet, based on target log information related to a communication log in a target device and a target log format indicating a description pattern of the target log information; a generation unit that generates first communication pattern information regarding a pattern of communication performed between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information, the first communication pattern information including source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address; An information processing device comprising:

2. a specifying unit that calculates start IP address information indicating a start IP address having the smallest numerical value among a plurality of IP addresses included in each of a plurality of subnet addresses, and end IP address information indicating an end IP address having the largest numerical value among the plurality of IP addresses included in each of a plurality of subnet addresses, and specifies target subnet address information indicating a target subnet address corresponding to the target IP address based on whether the target IP address exists among the IP addresses between the start IP address and the end IP address; The identification unit identifying source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address; The information processing device according to claim 1 .

3. The generation unit generating second communication pattern information relating to a communication pattern for each subnet address performed between the source subnetwork and the destination subnetwork based on the first communication pattern information; The information processing device according to claim 1 .

4. The generation unit generating the first communication pattern information including source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork, and generating third communication pattern information relating to a communication pattern for each category performed between the source subnetwork and the destination subnetwork based on the generated first communication pattern information; The information processing device according to claim 1 .

5. The generation unit generating the third communication pattern information regarding a communication pattern for each category performed between the subnetwork to which the source server belongs and the subnetwork to which the destination server belongs; The information processing device according to claim 4 .

6. The generation unit generating the third communication pattern information regarding a communication pattern for each category performed between the subnetwork to which the source client belongs and the subnetwork to which the destination server belongs; The information processing device according to claim 4 .

7. an extraction step of extracting, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating the protocol type identified by a header portion located immediately after the IP header included in a header area of ​​a packet, based on target log information related to a communication log in a target device and a target log format indicating a description pattern of the target log information; a generation step of generating first communication pattern information relating to a communication pattern performed between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information, the first communication pattern information including source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address; An information processing program that causes a computer to execute the above.

8. An information processing method realized by a program executed by an information processing device, an extraction step of extracting, from the target log information, source IP address information indicating the IP address of the source in the communication log, destination IP address information indicating the IP address of the destination in the communication log, destination port number information indicating the port number of the destination, and protocol information indicating the protocol type specified by a header portion located immediately after the IP header included in a header area of ​​a packet, based on target log information related to a communication log in a target device and a target log format indicating a description pattern of the target log information; a generating step of generating first communication pattern information relating to a communication pattern performed between the source and the destination based on the source IP address information, the destination IP address information, the destination port number information, and the protocol information, the first communication pattern information including source subnet address information indicating a subnet address corresponding to the source IP address and destination subnet address information indicating a subnet address corresponding to the destination IP address; An information processing method including:

Images