Information processing device, program, and information processing method

Abstract

It can also detect unknown attacks. [Solution] The information processing device comprises an acquisition unit that acquires access request information including multiple elements, and a format creation unit that creates a format of the access request information by performing an integration process that sets one or more analysis targets for the value of each of the elements for each of the multiple pieces of access request information by treating one or more values ​​as one analysis target depending on at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of the values, an analysis process that analyzes the formal attributes of the values ​​included in the analysis target for each of the analysis targets, and a setting process that sets the acceptance criteria for the elements based on the analyzed formal attributes.

Description

[Technical Field]

[0001] The present invention relates to an information processing device, a program, and an information processing method. [Background technology]

[0002] In recent years, various web applications have been provided via the Internet. However, as services become more widespread and expand, cyber attacks on web applications are also on the rise. Various cyber attack methods are known, including SQL (Structured Query Language) injection and OS (Operating System) command injection.

[0003] Conventionally, methods of using a WAF (Web Application Firewall) to respond to cyber attacks on these web applications have been known (see, for example, Patent Document 1). One type of WAF is a technology that detects attacks and blocks communications by creating and matching a pattern file (blacklist) using data strings from past cyber attacks. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-134972 Summary of the Invention [Problem to be solved by the invention]

[0005] However, existing WAFs are unable to deal with unknown attacks (zero-day attacks) because they use a pattern file created using data sequences from past attacks and perform matching. Furthermore, existing WAFs can be completely neutralized and defeated by using artificial intelligence (AI) to automatically generate a variety of subtly different attacks.

[0006] The present invention has been made in consideration of the above-mentioned points, and aims to provide a technology that can detect unknown attacks as well. [Means for solving the problem]

[0007] One aspect of the present invention is an information processing device comprising: an acquisition unit that acquires access request information including a plurality of elements; an integration process that sets one or more analysis targets for the value of each of the elements for each of the plurality of pieces of access request information by treating one or more values ​​as a single analysis target depending on at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of the values; an analysis process that analyzes, for each of the analysis targets, the formal attributes of the values ​​included in the analysis target; and a setting process that sets acceptability criteria for the values ​​based on the analyzed formal attributes, thereby creating a format for the access request information.

[0008] In one aspect of the present invention, the format creation unit sets the analysis target by assigning, to the multiple types of values, at least one type of key from among multiple types of keys, the key being determined depending on at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of the values.

[0009] In addition, in one aspect of the present invention, when the overlap rate based on the number of types of values ​​and the number of pieces of access request information is below a predetermined value, the format creation unit assigns a first key to all of the element values, setting them as one analysis target, and sets the acceptance criteria for the first key based on the formal attributes of the values ​​to which the first key is assigned.

[0010] In addition, in one aspect of the present invention, when the number of types of values ​​is greater than or equal to a predetermined number, the format creation unit assigns a second key to a value of the element whose frequency of occurrence is less than or equal to a predetermined number, thereby setting the value as one of the analysis targets, and sets the acceptance criteria for the second key based on the formal attributes of the value to which the second key is assigned.

[0011] In one aspect of the present invention, the format creation unit assigns a third key to a value of the element whose frequency of occurrence is equal to or greater than a predetermined value, sets the value as one of the analysis targets, sets the acceptance criteria for the third key based on the formal attributes of the value to which the third key is assigned, and sets the value to which the third key is assigned itself as the acceptance criteria for the value.

[0012] In addition, in one aspect of the present invention, the information processing device further includes a judgment unit that judges access to the server using the access request information to be normal when the access request information to the server conforms to the acceptance judgment criteria for each of the elements included in the format created by the format creation unit.

[0013] Another aspect of the present invention is a program that causes a computer to execute an acquisition step of acquiring access request information including multiple elements; an integration process of setting one or more analysis targets for the value of each of the multiple pieces of access request information by treating one or more values ​​as one analysis target depending on at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of the values; an analysis process of analyzing, for each analysis target, the formal attributes of the values ​​included in the analysis target; and a setting process of setting acceptance criteria for the elements based on the analyzed formal attributes, thereby creating a format of the access request information.

[0014] Another aspect of the present invention is The computer an acquisition step of acquiring access request information including a plurality of elements; and The computer an integration process for setting one or more analysis targets for each of the element values ​​by treating one or more of the values ​​as one analysis target according to at least one of the values ​​of the elements, the frequency of occurrence of the values, and the number of types of the values; The computer an analysis process for analyzing, for each of the analysis objects, the formal attributes of the values ​​included in the analysis object; The computer and a setting process for setting an acceptance criterion for the element based on the analyzed formal attributes, thereby The computer and a format creation step of creating a format for the access request information. [Effects of the Invention]

[0015] According to the present invention, unknown attacks can also be detected. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a block diagram illustrating an example of the configuration of an information processing system 1 according to an embodiment. [Figure 2]1 is a block diagram illustrating an example of a functional configuration of an information processing device 10 according to an embodiment. [Figure 3] FIG. 10 is a diagram showing an example of preprocessing by the format creation unit 12. [Figure 4] 10 is a diagram showing an example of access request information A converted by a format creating unit 12. FIG. [Figure 5] 10 is a diagram for explaining the integration process and analysis process performed by the format creation unit 12. FIG. [Figure 6] 10 is a flowchart illustrating an example of a processing flow of the information processing device 10 according to the embodiment. [Figure 7] FIG. 2 is a diagram illustrating an outline of a hardware configuration example of an information processing device 90 applied to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0017] [Embodiment] An information processing device, a program, and an information processing method according to preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings. In the drawings, identical or similar parts are designated by the same or similar reference numerals. Note that the present embodiments are not limited to these embodiments and include various modifications or improvements. In other words, the components described below include those that would be easily conceivable to a person skilled in the art or that are substantially identical, and the components described below can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of components may be made within the scope of the present invention. Note that, throughout all drawings used to describe the embodiments, components having the same function are designated by the same reference numerals, and repeated explanations will be omitted. Furthermore, in this application, "based on XX" means "based on at least XX" and includes cases where the information is based on other elements in addition to XX. Furthermore, "based on XX" is not limited to cases where XX is used directly, but also includes cases where XX has been calculated or processed. "XX" represents any element (e.g., any information). Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0018] [Example of information processing system configuration] FIG. 1 is a block diagram illustrating an example of the configuration of an information processing system 1 according to an embodiment. The information processing system 1 includes an information processing device 10, a terminal 20, and a subsequent server 30. For the sake of explanation, FIG. 1 shows an example in which one terminal 20 is connected to one information processing device 10, but multiple terminals 20 may be connected to one information processing device 10. When there is no need to distinguish between the case in which there is one terminal 20 and the case in which there are multiple terminals 20, they may simply be referred to as terminals 20. Similarly, multiple subsequent servers 30 may be connected to one information processing device 10.

[0019] The information processing device 10 and the terminal 20 are communicably connected via a network N1. The information processing device 10 and the subsequent server 30 are communicably connected via a network N2. The networks N1 and N2 may be networks using wireless communication or may be networks using wired communication. The networks N1 and N2 may be configured using, for example, the Internet or a local area network (LAN). The networks N1 and N2 may be configured by combining a plurality of networks.

[0020] The information processing device 10 acquires access from the terminal 20 to the subsequent server 30 and determines whether to forward the access to the subsequent server 30 or block it. That is, the information processing device 10 relays the access from the terminal 20 to the subsequent server 30. The terminal 20 is operated by a user. The terminal 20 is an information processing device such as a personal computer, tablet, or smartphone, and is equipped with a browser for browsing a website provided by the subsequent server 30. The terminal 20 is, for example, a user terminal that accesses a site. The subsequent server 30 is an information processing device that provides a website to the terminal 20 in accordance with an access request from the terminal 20. The subsequent server 30 is a server that should originally receive access from the terminal 20.

[0021] [Functions of information processing device] 2 is a block diagram illustrating an example of the functional configuration of an information processing device 10 according to an embodiment. The information processing device 10 includes, as its functional units, an acquisition unit 11, a format creation unit 12, a determination unit 13, and an output unit 14. Each of these functional units may be realized using an electronic circuit as necessary. Furthermore, each functional unit does not have to be included in a single device, and the information processing device 10 may be configured from multiple devices.

[0022] [Format creation stage] First, the acquisition unit 11 and the format creation unit 12 will be described, along with an explanation of how the format F of the access request information A is created from the access request information A. The format F of the access request information A is information indicating the formal attributes of the access request information A.

[0023] The acquisition unit 11 acquires access request information A. The acquisition unit 11 acquires the access request information A input to the information processing device 10, and therefore may be referred to as an input unit. The access request information A is information regarding an access request from the terminal 20 to the subsequent server 30. The access request information A includes a plurality of elements M. The elements M include, for example, a domain, a path, a query, etc., or further subdivisions of these. The acquisition unit 11 may acquire the access request information A from the terminal 20 in real time, or may acquire a log of the access request information A from a server or the like that stores the access request information A output from one or more terminals 20. The acquisition unit 11 may also store the access request information A acquired from the terminal 20 in a storage unit or the like. The acquisition unit 11 may be referred to as a log acquisition unit.

[0024] The format creation unit 12 acquires a plurality of pieces of access request information A from the acquisition unit 11, a storage unit (not shown), or the like. The format creation unit 12 creates a format F of the access request information A based on the acquired access request information A. The plurality of pieces of access request information A are, for example, a predetermined period (e.g., one hour) or a predetermined number (e.g., 10,000) of pieces of access request information A. The predetermined period and the predetermined number may be set in advance by a designer or administrator of the information processing device 10.

[0025] [Format creation stage: Preprocessing] The format creation unit 12 performs preprocessing on the access request information A. The format creation unit 12 breaks down the access request information A into domains, paths, queries, etc., and into elements M that further subdivide these. Furthermore, the format creation unit 12 may, for example, flatten a hierarchical data format. This unifies the data format of the access request information A into a simple configuration, making it easier to create the format F. The above-mentioned processes of breaking down and flattening down may be referred to as preprocessing, etc.

[0026] FIG. 3 is a diagram showing an example of preprocessing by the format creation unit 12. For example, if the data description format of the access request information A is "JSON (JavaScript Object Notation)", the format creation unit 12 converts it into a key-value map KVM by breaking down and flattening the hierarchical structure (key-value treemap KVTM). In addition, if the access request information A can be decoded using "Base64" or the like, the format creation unit 12 decodes it. If the access request information A is encoded using "www-form-url-encoded", the format creation unit 12 decodes it and converts it into a key-value map KVM. If the data description format of the access request information A is "url-query", the format creation unit 12 decodes it and converts it into a key-value map KVM. If the access request information A includes a regular expression such as "a-zA-Z0-9+ / -_!:.", the format creation unit 12 splits it at ".".

[0027] By performing the above-described preprocessing, the access request information A is converted into a predetermined data description format. FIG. 4 is a diagram showing an example of the access request information A converted by the format creation unit 12. Below, the process for creating the format F will be explained using as an example a case where multiple pieces of access request information A are converted into the data description format shown in FIG. 4. In FIG. 4, the access request information A includes a first element M1 to a seventh element M7. The format creation unit 12 creates the format F of the access request information A by performing integration processing and analysis processing for each element M on the multiple pieces of access request information A.

[0028] [Format creation stage: integration processing] The format creation unit 12 performs an integration process on multiple pieces of access request information A. Each element M has a value. A value is information held by the element M and is not limited to a number. The element M may be any character string, such as a number, a symbol, or an alphabet. For example, in FIG. 4, the second element M2 has a value of "newsroom." For example, when analyzing a formal attribute of the element M, such as whether the value appears at the end, the format creation unit 12 sets a value to be analyzed. For example, the value to be analyzed may be "values ​​with the same value." The integration process is a process of collectively managing multiple values ​​as analysis targets. In the integration process, one or multiple types of values ​​are integrated and managed as a single analysis target according to at least one of the respective values, their frequency of occurrence, and the number of types of values. The format creation unit 12 integrates and manages the values, for example, by setting one or multiple values ​​as a single analysis target.

[0029] During the integration process, the format creation unit 12 may attach integration information indicating that the values ​​of the elements M to be processed in the multiple pieces of access request information A are the same analysis target. The integration information is, for example, stored separately from the values. The integration information may be referred to as a key. Furthermore, when the analysis target does not include different types of values, that is, when the analysis target includes only one type of value, the format creation unit 12 may attach that value as integration information. In the following description, integration information attached when the analysis target includes different types of values ​​may be referred to as an integration key (such as an any key, which will be described later). On the other hand, integration information attached when the analysis target does not include different types of values ​​may be referred to as a specified key.

[0030] In addition, if element M has a value and a key as a pair before the integration process, the format creation unit 12 may replace the key to be integrated with integration information, or may assign the integration information separately from the key. For example, if second element M2 has a value "newsroom" and a key "designated key "newsroom"" similar to the value before the integration process, the format creation unit 12 may replace the key with an integrated key when integrating, or may assign it separately from the "designated key "newsroom"". Furthermore, if only elements having the value "newsroom" are to be analyzed, the format creation unit 12 may retain the designated key without assigning an integrated key. This makes it possible to manage each of the values ​​included in one analysis target.

[0031] There are multiple types of integrated keys that can be set by the format creation unit 12. The format creation unit 12 determines which integrated key to use based on each value and the frequency of occurrence of that value.

[0032] [Integration key: any key] The integrated key includes an any key. The any key is an integrated key that is set for multiple pieces of access request information A in which the values ​​of element M are almost non-overlapping. The value set in the any key is, for example, a machine-generated value, and often has a fixed formal attribute (format), making it easy to analyze (guess) the format trend. The value that is integrated by setting the any key is, for example, a highly random value such as a token, a user name, or a time.

[0033] The any key is an integrated key that integrates values ​​that often differ for each access. Therefore, whether or not to set the any key is determined based on the value duplication rate among multiple pieces of access request information A. The duplication rate is calculated based on the number of types of values ​​(the number of key values) that appear in the element M to be processed and the number of access request information A (the number of analysis samples). For example, the any key is set under the condition that the ratio (duplication rate) of the number of types of values ​​that appear in the element M to the number of types of values ​​that appear is equal to or less than a predetermined value. The number of types of values ​​can be easily measured by determining whether a value has appeared in the past. If a value has not appeared, the number of types of values ​​can be easily measured by counting the number of types of values ​​stored. The number of types of access request information A can also be easily measured by counting the number of access request information A used by the format creation unit 12 to create the format F. These values ​​can also be easily updated by continuing to measure, even if the number of access request information A used to create the format F changes. Therefore, the duplication rate can be easily calculated based on these two values.

[0034] For example, if the duplication rate is equal to or lower than a predetermined value, the format creation unit 12 integrates all values ​​appearing in the element M to be processed into an any key. The predetermined value serving as the threshold for the duplication rate may be, for example, 2. In other words, if the duplication rate is such that each value is not duplicated twice, each value may be assumed to be a highly random, machine-generated value and integrated into an any key. Values ​​that rarely overlap are highly random, and even if a designated key is assigned to each value, they are unlikely to match unknown access request information A. Furthermore, because mismatches can occur in both normal and abnormal accesses, they are unlikely to be used as format F. Therefore, when creating an any key, it is desirable to treat all values ​​appearing in the element M to be processed as a single analysis target and not assign a designated key. Note that the predetermined value may be predetermined by the designer, administrator, or the like of the information processing device 10.

[0035] FIG. 5 is a diagram illustrating the integration process and analysis process by the format creation unit 12. With reference to FIG. 5, a case where data is integrated into an any key, which is one of the integrated keys, will be described. In FIG. 5, the format creation unit 12 uses multiple pieces of access request information A, from the first access request information A1 to the n-th access request information An, to create a format F. In FIG. 5, the element M to be processed is the seventh element M7, and the value held by the seventh element M7 is a parameter indicating time. Therefore, the value held by the seventh element M7 is a machine-generated value that is unlikely to be duplicated. Therefore, the value of the seventh element M7 of the access request information A is integrated into the any key and managed as a single analysis target.

[0036] [Integration key:rest key] The integrated key also includes a rest key. The rest key is an integrated key that is set for values ​​that may be duplicated but have a sufficiently large number of different values. The value integrated by setting the rest key is, for example, a string related to content dynamically added by the user. The value set in the rest key is, for example, a user-generated value and a public value, and it is easy to analyze formal attributes (restrictions) such as character type. The value integrated by setting the rest key is, for example, a site name or other value that can be dynamically added by the user.

[0037] Since the rest key is an integrated key that integrates values ​​that can be dynamically added by the user, it is preferable to determine whether the rest key can be set based on the number of types of values. For example, the setting condition for the rest key is that the number of types of values ​​that appear in the element M to be processed is greater than or equal to a predetermined number. The predetermined value that serves as the threshold for whether the rest key can be set may be, for example, a sufficiently large value (e.g., 100) based on the access request information A. If the threshold is greater than 100, the possibility of compatibility decreases and it may become impractical. Furthermore, the predetermined value may be, for example, the ratio of the number of types of values ​​to the access request information A. Note that the predetermined value may be determined in advance by a designer, administrator, or the like of the information processing device 10.

[0038] The format creation unit 12 integrates into the rest key, among values ​​that appear in the element M to be processed, values ​​whose value based on the frequency of occurrence is equal to or lower than a predetermined value. In other words, it integrates into the rest key values ​​with a low frequency of occurrence. The value based on the frequency of occurrence may be the frequency of occurrence itself. In the case where the value is the frequency of occurrence itself, the threshold may be the number of occurrences. Furthermore, the value based on the frequency of occurrence may be a value indicating the frequency of occurrence. The value indicating the frequency of occurrence may be, for example, a ranking indicating the frequency of occurrence of each type of value. In the case where the ranking is the frequency of occurrence of each type of value, the threshold may be the lowness of the ranking, and for example, the values ​​of types in the bottom 10% of the ranking according to frequency of occurrence may be the target of analysis. The predetermined value serving as the threshold for the value based on the frequency of occurrence may be predetermined by the designer, administrator, etc. of the information processing device 10.

[0039] That is, the format creation unit 12 retains some values ​​that are accessed intensively, such as site names, as specified keys, and integrates other values ​​that are accessed less into the rest key. This allows values ​​that are accessed intensively to be configured as the values ​​themselves in format F, and values ​​that are not accessed intensively to have their formal attributes configured in format F. Values ​​that are to be integrated into the rest key are public values, and therefore are prone to being targets of attacks. By not integrating frequently occurring values ​​into the rest key but instead retaining the values ​​themselves as specified keys, the checking standards for format F are maintained high.

[0040] [Integrated key: all key] The integrated key also includes the all key. The all key is an integrated key that is set for items with special patterns that are accessed only once every few days. The value that is integrated by setting the all key is, for example, a user-generated value and a private value, a value that is entered by the user but is rarely displayed to other users. The value that is integrated by setting the all key is, for example, an account name.

[0041] The all key is an integrated key for handling values ​​of special input patterns. Because it is a private value that is unlikely to be the target of attacks, it is sufficient to grasp a general trend. Therefore, for example, the all key integrates (analyzes) the major components of values ​​appearing in the processing response element M. The determination of whether or not a value is a major component may be performed, for example, using a value based on the frequency of appearance. As with the rest key, the format creation unit 12 may perform the determination based on the order of appearance frequency. For example, the format creation unit 12 may analyze the values ​​in the top 50% of the ranked types (the total number is the number of value types). Furthermore, the format creation unit 12 does not need to determine whether or not a value is a major component for each value type. For example, when each value is sorted in order of appearance frequency, the format creation unit 12 may analyze the values ​​in the bottom 10% of the ranked types (the total number is the number of access request information A). In other words, the format creation unit 12 analyzes the basic patterns appearing in the element M by integrating the major components of the values ​​and using them as the analysis target. This allows the creation of a format F that can appropriately determine whether or not an attack has occurred even when an unusual pattern that is different from usual is input.

[0042] In the case of the any key and the rest key, the value to be integrated has a low frequency of occurrence and is difficult to use as format F. Therefore, when the any key and the rest key are added, it is preferable not to add a specified key, or to replace the specified key if one has already been added. On the other hand, in the case of the all key, the value to be integrated has a high frequency of occurrence and is a value that is a major component in element M, making it easy to use in format F. Therefore, even when the all key is added, it is preferable to add a specified key, or to add a specified key separately from the specified key if one has already been added.

[0043] According to the above-described integration process, at least one of an integrated key and a specified key can be assigned to all values ​​appearing in the element M to be processed. The specified key is intended for strings used for special functions created directly by programmers, etc. Because these values ​​may become vulnerable if an unused value is entered, it is desirable to allow only fixed values. Therefore, the specified key does not analyze multiple values, but only one value. The specified key, any key, rest key, and all key are assigned according to the characteristics of values ​​that appear when the program actually runs, so these keys can handle various values ​​included in the access request information A. The specified key, any key, rest key, and all key are examples of integrated keys, and other integrated keys may be used. The number of types of integrated keys may be less than three or more than three.

[0044] [Format creation stage: analysis processing] The format creation unit 12 analyzes the formal attributes of the values ​​included in each analysis target. An analysis target is a value that has the same integration information attached and is included in the same specified key, any key, rest key, or all key. If one value is set in multiple analysis targets, that value is used to analyze each key.

[0045] 5, the values ​​of the seventh element M7 of the multiple access request information A are assigned an any key and are treated as a single analysis target. The format creation unit 12 analyzes the formal attributes based on all values ​​assigned the any key, i.e., the values ​​appearing in the seventh element M7 of the first access request information A1 to the n-th access request information An.

[0046] A formal attribute is a characteristic pattern of values ​​that appear, and may be, for example, what kind of value appears, or where it appears in the access request information A. For example, the format creation unit 12 may analyze "presence or absence of a value," "data length range," and "type of character class" as formal attributes of values. The above-mentioned three types of formal attributes are examples, and the present embodiment is not limited to these examples.

[0047] [Format creation stage: setting process] The format creation unit 12 sets the acceptance criterion VF based on the analyzed formal attributes. The acceptance criterion VF is a criterion for determining whether an element M of unknown access request information A is acceptable. The format creation unit 12 sets the acceptance criterion VF for passing element M based on the probabilistic numerical value of the appearance of a certain formal attribute value. That is, the format creation unit 12 sets the acceptance criterion VF based on the regularity of the appearance of a certain value based on the values ​​included in the analysis target. The format creation unit 12 may set the acceptance criterion VF, for example, using a formal attribute with a probability greater than 0 (one that has appeared even once). Setting of the acceptance criterion VF will be described using the following formal attribute as an example.

[0048] The "presence or absence of a value" refers to, for example, whether a value exists next to the target value in the access request information A, i.e., whether the value is at the end. The format creation unit 12 analyzes the "presence or absence of a value" for each value included in the analysis target. The format creation unit 12 analyzes the formal attribute "presence or absence of a value" by counting the number of times the value was at the end and the number of times the value was not at the end for the analysis target value. If all the values ​​included in the analysis target are at the end, the format creation unit 12 sets the acceptance criterion VF of "the next value definitely does not exist." On the other hand, if all the values ​​included in the analysis target are not at the end, the format creation unit 12 sets the acceptance criterion VF of "the next value definitely exists." Furthermore, if some of the values ​​included in the analysis target are at the end and some of the values ​​included in the analysis target are not at the end, the format creation unit 12 sets the acceptance criterion VF of "it is unclear whether the next value exists."

[0049] The "data length range" is, for example, the range of possible data lengths of a value. The format creation unit 12 analyzes the "data length" of each value included in the analysis target. The format creation unit 12 identifies the data length of each value included in the analysis target and stores the longest and shortest data lengths, thereby setting an acceptable criterion VF called the "data length range" for the values ​​included in the analysis target. The format creation unit 12 may perform predetermined processing on the stored data lengths. For example, the format creation unit 12 may set the acceptable criterion VF for the "data length range" to a value that allows for a margin of ±1 for the data length expressed in "log_2". Specifically, the format creation unit 12 may set the "data length range" to be between "the shortest data length - 1" and "the longest data length + 1".

[0050] The "character class type" refers to, for example, the type of character class (character type) of characters, symbols, etc. contained in a string. Character classes include various character types such as alphabets, numbers, symbols, and blank characters. For example, the format creation unit 12 analyzes the "character class" contained in each value included in the analysis target. Furthermore, by retaining the type of character class identified as being included, the format creation unit 12 sets one or more character classes contained in any value in the analysis target as the acceptance criterion VF called the "character class type." The above-mentioned acceptance criterion VF is set for the rest key, all key, and specified key. Note that, since the analysis target for the specified key is the same value, whether the value itself is the acceptance criterion VF may be treated as the acceptance criterion VF.

[0051] The format creation unit 12 creates a format F of the access request information A by performing the above-described integration process, analysis process, and setting process for each element M. For example, an example of creating the format F will be described using a case where a specified key, any key, rest key, and all key are set for a certain element M. The format creation unit 12 performs the integration process, analysis process, and setting process on the value (the value of the next element M) that appears next to the value assigned with the specified key (the same value as the specified key), and links the higher-level key with the key (lower-level key) of the element M next to the higher-level key. In addition, the format creation unit 12 performs the same process as for the specified key for each of the any key, rest key, and all key. As a result, the format creation unit 12 creates a tree-like format F in which a certain key is linked to a key that is likely to appear next to that key. The format F indicates the acceptance criteria VF of the access request information A and is obtained by analyzing what values ​​the input access request information A will take. The format creation unit 12 may store the created format F in a storage unit or may output it to an external device. Note that linking may mean storing information indicating a relationship between both the upper key and the lower key, or storing the upper key and the lower key in an array-type data structure.

[0052] In format F, a separate key is set for each key of a higher-level element M in the lower-level element M. For example, in format F, keys "A1," "A2," and "A3" may be set in the second element M2 linked to the key "A" of the first element M1, and keys "B1," "B2," and "B3" may be set in the second element M2 linked to the key "B" of the first element M1. Note that A1 to A3 and B1 to B3 do not necessarily have to have different keys or acceptance criteria VF, and may be the same.

[0053] [Decision stage] The acquisition unit 11 acquires access request information A from the terminal 20. The determination unit 13 acquires the access request information A by referring to the storage unit. The determination unit 13 performs preprocessing on the new access request information A similar to that performed by the format creation unit 12. The determination unit 13 compares the new access request information A with the format F. If the new access request information A conforms to the format F, the determination unit 13 determines that access to the subsequent server 30 using the access request information A is normal, i.e., is not an attack. The output unit 14 outputs (transfers) the access request information A determined to be normal to the subsequent server 30 that is the access destination. On the other hand, if the new access request information A does not conform to the format F, the determination unit 13 determines that access to the subsequent server 30 using the access request information A is abnormal, i.e., is an attack, fraud, or the like. The output unit 14 blocks the access request information A determined to be abnormal and does not output it to the subsequent server 30 that is the access destination. An example of determining whether or not the information conforms to the format F will be described in detail. In this case, an example will be described in which the format F uses a format that is connected to each element M. This format F is a format in which various patterns are prepared in a tree structure from the first element M1 to the lower element M.

[0054] [Judgment:Specified key] If the value of element M in access request information A that is being judged for suitability matches the specified key of element M referenced in format F, the judgment unit 13 judges that the value of the target element M is suitable, and performs judgment on the next element M.

[0055] [Judgment: Integrated Key] If the value of the access request information A does not match the specified key of the format F, the determination unit 13 determines that the value of the target element M matches if an integrated key is set for the referenced element M and the formal attribute of the value of the element M to be determined to match in the access request information A satisfies the acceptance criteria VF of the integrated key, and performs the determination on the next element M. In other words, integrated keys such as the any key, rest key, and all key function as wildcards, and are determined to match if they satisfy the acceptance criteria VF even if the character strings do not match. If the determination unit 13 determines that neither the specified key nor the integrated key matches, it determines that the value of the target element M does not match, and performs the determination process on other keys of the upper element M. The determination unit 13 determines that the access request information A that has passed (matched) up to the last element M of the format F is normal access. For example, if new access request information A is decomposed into seven elements, from the first element M1 to the seventh element M7, the determination process is performed at least seven times to determine whether each seventh element M7 conforms to the format F. The determining unit 13 determines that the access request information A that does not pass the format F is an abnormal access.

[0056] [Processing flow of information processing device] 6 is a flowchart for explaining an example of the flow of processing performed by the information processing device 10 according to the embodiment. The flow of processing performed by the information processing device 10 will be explained with reference to the same figure.

[0057] (Step S101) The information processing device 10 acquires a predetermined number (e.g., 10,000 pieces) of access request information A or for a predetermined period (e.g., one hour). The information processing device 10 may acquire multiple pieces of access request information A stored as a log, or may store the acquired access request information A in a storage unit for reference when creating a format F. The stored access request information A may be the content of the access request information A itself, or may be decomposed into each element M (value) and stored. When decomposed into each value and stored, the information processing device 10 measures the appearance frequency of each value. For example, if a value that has previously appeared in the acquired access request information A exists, the information processing device 10 may add the value of a variable indicating the appearance frequency of that value. This reduces the amount of information when storing the log and further reduces the calculation time required for performing the integration process.

[0058] (Step S102) The information processing device 10 performs integration processing and analysis processing for each element M. The information processing device 10 integrates values ​​that appear by performing the integration processing and sets an analysis target to make analysis easier. The information processing device 10 also performs analysis processing to analyze the formal attributes of the values ​​included in the analysis target. By performing this processing for each element M and setting an acceptance criterion, the information processing device 10 creates a format F for the access request information A.

[0059] (Step S103) The information processing device 10 acquires new (unknown) access request information A from the access source terminal 20. The access destination of this access request information A is the subsequent server 30.

[0060] (Step S104) The information processing device 10 determines whether the new access request information A conforms to the created format F. Specifically, the information processing device 10 determines whether the value included in the access request information A matches the specified key included in the format F or satisfies the acceptance criteria VF of the integrated key included in the format F.

[0061] (Step S105) If the new access request information A conforms to the format F (Step S104; Yes), the information processing device 10 determines that the new access request information A is a normal access, and outputs it to the subsequent server 30. As a result, the terminal 20 performing normal access can access the subsequent server 30.

[0062] (Step S106) If the access request information A does not conform to the format F (Step S104; No), the information processing device 10 determines that the new access request information A is an abnormal access and does not output it to the subsequent server 30. As a result, the terminal 20 performing the abnormal access cannot access the subsequent server 30.

[0063] 6, the stage of creating the format F and the stage of determining the access request information A are shown separately. However, this embodiment is not limited to this example, and the stage of creating the format F and the stage of determining the access request information A do not need to be clearly distinguished. For example, when acquiring new access request information A, the information processing device 10 may determine whether the access request information A conforms to the already created format F, while storing the access request information A in the storage unit for creating the format F. In other words, step S101 and step S103 may be the same process.

[0064] Furthermore, if the creation of the format F is not complete, for example, if sufficient information has not been obtained for some elements M in the format F, it is not necessary to perform a judgment on that element M. For example, if an element M in the format F has not been accessed a predetermined number of times (e.g., 1,000 times) due to the creation of a new file, a flag "in learning" may be added, and the element M may be passed to the lower element M without a judgment on suitability. Since an appropriate format F may not be created if statistics are taken with limited information, it is desirable not to judge suitability for that element M if it has not been accessed a predetermined number of times. Even if some elements M in the format F have a label "in learning," as long as keys and acceptance criteria VF have been created in other formats F, it is possible to sufficiently determine whether the access request information A is an attack. Note that if there has been sufficient access to the "in learning" element M, only that element M in the format F may be updated, or a new format F may be created.

[0065] In the above, an example has been described in which the format creation unit 12 sets the acceptance criteria VF by including formal attributes that have appeared at least once in the past. However, this embodiment is not limited to this example. For example, the format creation unit 12 may set the acceptance criteria based on formal attributes that appear with a predetermined probability or higher (0.001%). Alternatively, the acceptance criteria may be set based on formal attributes of values ​​that are accessed from multiple access sources (three or more). For example, the format creation unit 12 basically sets the acceptance criteria VF by including formal attributes that have appeared at least once in the past. If it is desired to tighten the acceptance criteria VF, the acceptance criteria VF may be set using a threshold value for the occurrence rate or the number of accesses.

[0066] The above describes an example in which the information processing device 10 stores the access request information A either directly or by breaking it down into individual values ​​to create the format F. When breaking it down into individual values ​​and storing it, values ​​with the any key attached may not be stored. Values ​​with the any key attached are all integrated into the any key, and there is no need to measure the frequency of occurrence of each value, as with the rest key and all key. Therefore, they may not be stored. Furthermore, because it is sufficient to retain information indicating the character types that have appeared in the past in the case of the "character class type," the character strings of past values ​​are not required for setting the acceptance criteria VF. Therefore, past values ​​of the any key may not be stored. This reduces the storage capacity required for storing values ​​integrated into the any key. To create a specified key or an integrated key, it is preferable to measure the frequency of occurrence of values ​​for the rest key and the all key and continue to store values ​​that have appeared in the past.

[0067] In the above description, the all key has looser conditions than other integrated keys, but the actual determination is unlikely to be loose. For example, if an entity that takes almost exclusively unique values, such as a subdomain, is integrated into the all key, the acceptance criteria VF of the all key is almost the same as that of the specified key. Also, if the all key is set for an element M with a value such as a machine-generated value, the acceptance criteria VF will be the same as that of the any key. Therefore, even if an integrated key with relatively looser conditions, such as the all key, is set, it is difficult to loosen the conditions as with the conventional whitelist type, and attacks, etc. can be appropriately detected. Therefore, the information processing device 10 can detect unknown attacks.

[0068] In the above description, it has been explained that one information processing device 10 may be connected to a plurality of subsequent servers 30. From the viewpoint of the information processing device 10 creating a format of access request information for the subsequent server 30 and determining whether or not an attack has occurred, it is more desirable that the information processing device 10 be connected to only one subsequent server 30. This allows the information processing device 10 to create a format F specialized for access request information for the subsequent server 30, thereby improving the accuracy of the determination.

[0069] In the above, an example has been described in which the information processing device 10 and the subsequent server 30 are configured separately. However, the present embodiment is not limited to this example, and the information processing device 10 may be configured within the subsequent server 30. For example, the functions of the information processing device 10 may be realized by the subsequent server 30.

[0070] [Summary of the embodiment] According to the above-described embodiment, the information processing device 10 includes an acquisition unit 11 that acquires access request information A including multiple elements M; an integration process that sets one or more analysis targets for each value of element M for the multiple pieces of access request information A by treating each value of element M as a single analysis target according to at least one of the values ​​of element M, the frequency of occurrence of the value, and the number of types of values; an analysis process that analyzes the formal attributes of the value included in each analysis target; and a setting process that sets the acceptance criteria VF for element M based on the analyzed formal attributes, thereby creating a format F for the access request information A. Conventional whitelist-based fraud detection requires updating the configuration file every time the subsequent server 30 is updated. However, the information processing device 10 can automate configuration updates by accumulating information and creating a format F when accesses violating a specified format are received from multiple IP addresses during a standby time. That is, updates to the subsequent server 30 can be automatically accommodated by extending the format F.

[0071] Furthermore, conventional whitelist-based detection methods perform lenient checks that allow most values ​​to pass, i.e., checks that are very similar to blacklist-based checks that define values ​​that cannot be passed, resulting in extremely low effectiveness in detecting attacks and fraud. Furthermore, if the check criteria were increased to improve detection accuracy, it could be unable to handle dynamically added content, such as the addition of new paths, and individual settings for fluctuating values ​​may be required. Therefore, conventional whitelist-based detection methods often resulted in false positives, making them difficult to use except in situations where access methods, such as application programming interfaces (APIs), are strictly limited. Furthermore, conventional whitelist-based and blacklist-based methods require manual or partially automated creation of pattern files, preventing fully automatic generation. This makes it difficult to take measures against patterns unknown to administrators. In contrast, the information processing device 10 uses three types of integrated keys—the any key, the rest key, and the all key—to fully automatically create a detection format without prior knowledge of attacks. Furthermore, the information processing device 10 can extend the detection format to accommodate content whose values ​​change dynamically, such as CGM (Consumer Generated Media). Therefore, the information processing device 10 according to the embodiment can detect unknown attacks, etc., and respond to zero-day attacks, etc. Note that, in the past, the amount of calculation and data volume was too large for computers to implement the technology according to the embodiment, but the recent increase in computer performance has made the approach according to the embodiment possible.

[0072] Furthermore, according to the above-described embodiment, the format creation unit 12 sets the analysis target by assigning, to each value, at least one of multiple types of keys, a key determined based on each value of element M, the frequency of occurrence of the value, and / or the number of types of values. That is, the integrated key, which is a key assigned to set multiple types of values ​​as analysis targets, includes multiple types, such as any key, rest key, and all key. The integrated key to be set is determined based on the tendency of the values ​​to appear. When determining whether or not a format F is compatible, the integrated key functions as a so-called wildcard. Typically, one type of wildcard, which can be any value, is sufficient. For example, the wildcard representing "any zero or more characters" is the single type, "* (asterisk)." In contrast, the format creation unit 12 according to the embodiment sets multiple types of wildcards. By providing multiple types of wildcards, wildcards can be appropriately created in accordance with the characteristics of values ​​generated by program execution. This allows the information processing device 10 to create a high-quality format F even in a fully automated environment.

[0073] Furthermore, according to the above-described embodiment, when the overlap rate based on the number of types of values ​​and the number of pieces of access request information A is equal to or less than a predetermined value, the format creation unit 12 assigns an any key to all values ​​of element M, thereby setting them as a single analysis target, and sets an acceptance criterion VF for the any key based on the formal attributes of the values ​​to which the any key is assigned. In this case, the any key may be referred to as a first key. For values ​​with high randomness, such as machine-generated values, even if the values ​​themselves are included in the format F, the likelihood of a match is extremely low. Therefore, a mismatch cannot be used to determine whether the access is normal or abnormal, and the format F is not suitable. Furthermore, manually creating a format for such machine-generated values ​​is extremely time-consuming. According to the information processing device 10 according to the embodiment, it is possible to appropriately analyze the formal attributes of machine-generated values ​​and automatically create a format F that can handle highly random values, such as machine-generated values ​​of unknown access request information A.

[0074] Furthermore, according to the above-described embodiment, when the number of types of values ​​is greater than or equal to a predetermined number, the format creation unit 12 assigns a rest key to values ​​of the element M whose frequency-of-appearance values ​​are less than or equal to a predetermined number, thereby setting them as a single analysis target. The format creation unit 12 then sets the acceptance criteria VF for the rest key based on the formal attributes of the value to which the rest key is assigned. In this case, the threshold for the number of types of values ​​and the threshold for the frequency-of-appearance values ​​may be different from each other. The rest key may also be referred to as a second key. That is, the format creation unit 12 retains some values ​​that are accessed intensively, such as site names, as designated keys, and integrates other values ​​that are accessed less frequently into the rest key. This allows the format creation unit 12 to detect attacks by identifying the values ​​that are accessed intensively (major ones) themselves, while also identifying the formal attributes of values ​​that are not accessed intensively and responding flexibly. This makes it possible to create a format F that can appropriately determine whether or not an attack has occurred for unknown access request information A.

[0075] Furthermore, according to the above-described embodiment, the format creation unit 12 assigns an all key to a value of element M whose frequency-based value is equal to or greater than a predetermined value, thereby setting the value as a single analysis target. The all key is then set as the acceptance criterion VF for the all key based on the formal attributes of the value to which the all key is assigned. The value to which the all key is assigned is then set as the acceptance criterion VF for the value. In this case, the all key may be referred to as a third key. For example, when setting the all key, the format creation unit 12 may duplicate each of the target values, using one copy to analyze the formal attributes of the all key and the other copy to analyze the formal attributes of each value. This allows the format creation unit 12 to identify the main components of element M and accommodate rarely occurring patterns, while also including the values ​​themselves that are the main components in the format F. Furthermore, because the format creation unit 12 analyzes the formal attributes of the values ​​that are the main components as formal attributes of the all key, it is possible to prevent a decrease in the difficulty of passing the all key. Therefore, the information processing device 10 according to the embodiment can create a format F that is flexible and can handle unknown attacks.

[0076] Furthermore, according to the above-described embodiment, the information processing device 10 further includes a determination unit 13 that determines that access to the server (subsequent server 30) based on the access request information A is normal when the access request information A conforms to the formal attributes of each element M included in the format F created by the format creation unit 12. The information processing device 10 further including the determination unit 13 can appropriately determine unauthorized access or access intended for attack and block such access. Furthermore, the determination criteria are automatically updated when the format F is updated, so that it can easily accommodate updates and content whose values ​​change dynamically.

[0077] [Hardware configuration example] 7 is a diagram illustrating an outline of an example hardware configuration of an information processing device 90 applied to an embodiment. The information processing device 90 includes a processor 91, a main storage device 92, a communication interface 93, an auxiliary storage device 94, an input / output interface 95, and an internal bus 96. The processor 91, the main storage device 92, the communication interface 93, the auxiliary storage device 94, and the input / output interface 95 are communicably connected to each other via the internal bus 96. The information processing device 90 may be applied to, for example, the information processing device 10 or the subsequent server 30. In this case, for example, the acquisition unit 11 and the output unit 14 may be configured using the communication interface 93 and the input / output interface 95. For example, a storage unit (not shown) may be configured using the auxiliary storage device 94. Furthermore, the format creation unit 12 and the determination unit 13 may be configured using the processor 91 and the main storage device 92.

[0078] The information processing device 10 may be implemented using multiple information processing devices. For example, the information processing device 10 may be implemented using a device such as a cloud. For example, in the information processing device 10, the storage unit 22 and the control unit 23 may each be implemented in different information processing devices. For example, the storage unit 22 of the information processing device 10 may be distributed and implemented in multiple information processing devices. Note that all or part of the functions of each unit of the information processing device 10 in the above-described embodiment may be realized by recording a program for realizing these functions on a computer-readable recording medium, and loading and executing the program recorded on the recording medium into a computer system. Note that the term "computer system" here includes hardware such as an OS and peripheral devices.

[0079] Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, as well as storage units such as hard disks built into computer systems. Furthermore, "computer-readable recording media" may also include devices that dynamically store programs for a short period of time, such as communication lines used when transmitting programs over networks like the Internet or communication lines like telephone lines, or devices that store programs for a fixed period of time, such as volatile memory within computer systems that serve as servers or clients in such cases. Furthermore, the above-mentioned programs may be programs that realize some of the aforementioned functions, or may be programs that can realize the aforementioned functions in combination with programs already stored in the computer system.

[0080] Although one embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to the above, and various design modifications can be made without departing from the spirit of the present invention. Furthermore, the configurations described in the above-described embodiments and examples can be combined. [Explanation of symbols]

[0081] 1...information processing system, 10...information processing device, 20...terminal, 30...subsequent server, 11...acquisition unit, 12...format creation unit, 13...determination unit, 14...output unit, A...access request information, M...element, ...acceptance determination criteria, F...format

Claims

1. an acquisition unit that acquires access request information including a plurality of elements; For each of the plurality of pieces of access request information, an integration process for setting one or more analysis targets for each of the element values ​​by treating one or more of the values ​​as one analysis target according to at least one of the values ​​of the elements, the frequency of appearance of the values, and the number of types of the values; an analysis process for analyzing, for each of the analysis objects, the formal attributes of the values ​​included in the analysis object; a setting process for setting acceptance criteria for the element based on the parsed formal attributes; a format creation unit that creates a format of the access request information by performing the above steps; An information processing device comprising:

2. the format creation unit sets the analysis target by assigning, to the multiple types of values, the key being at least one type of key among multiple types of keys, the key being determined depending on at least one of each value of the element, the frequency of appearance of the value, and the number of types of the value; The information processing device according to claim 1 .

3. The format creation unit if a duplication rate based on the number of types of values ​​and the number of pieces of access request information is equal to or less than a predetermined value, assigning a first key to all of the element values ​​to set them as one analysis target, setting the acceptance criteria for the first key based on formal attributes of the value to which the first key is attached; 3. The information processing device according to claim 1.

4. The format creation unit when the number of types of the value is equal to or greater than a predetermined number, assigning a second key to a value of the element whose frequency of occurrence is equal to or less than a predetermined number, thereby setting the value as one of the analysis targets; setting the acceptance criteria for the second key based on formal attributes of the value to which the second key is attached; 3. The information processing device according to claim 1.

5. The format creation unit assigning a third key to a value of the element whose frequency of occurrence is equal to or greater than a predetermined value, and setting the value as one of the analysis targets; setting the acceptance criteria for the third key based on a formal attribute of the value to which the third key is assigned, and setting the value to which the third key is assigned itself as the acceptance criteria for the value; 3. The information processing device according to claim 1.

6. a determination unit that determines that access to the server based on the access request information is normal when the access request information to the server conforms to the acceptance criteria of each of the elements included in the format created by the format creation unit, The information processing device according to claim 1 or 2, further comprising:

7. On the computer, an acquisition step of acquiring access request information including a plurality of elements; For each of the plurality of pieces of access request information, an integration process for setting one or more analysis targets for each of the element values ​​by treating one or more of the values ​​as one analysis target according to at least one of the values ​​of the elements, the frequency of appearance of the values, and the number of types of the values; an analysis process for analyzing, for each of the analysis objects, the formal attributes of the values ​​included in the analysis object; a setting process for setting acceptance criteria for the element based on the parsed formal attributes; a format creation step of creating a format of the access request information by performing the above steps; A program that executes the following.

8. An acquisition step in which a computer acquires access request information including a plurality of elements; For each of the plurality of pieces of access request information, an integration process in which the computer sets one or more analysis targets for each of the element values ​​by treating one or more of the values ​​as one analysis target according to at least one of the values ​​of the elements, the frequency of appearance of the values, and the number of types of the values; an analysis process in which a computer analyzes, for each of the analysis objects, a formal attribute of the value included in the analysis object; a setting process in which the computer sets acceptance criteria for the element based on the analyzed formal attributes; a format creation step in which the computer creates a format of the access request information by performing the above steps; An information processing method including:

Images