Abnormality detection device or abnormality detection method
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Filing Date
- 2024-07-12
- Publication Date
- 2026-01-15
AI Technical Summary
Existing anomaly detection systems in embedded devices struggle to identify anomalies where events occur partially or out of sequence due to events being present in the normal list, making it difficult to detect these anomalies effectively.
The system aggregates events by occurrence parts and generates combinations for each occurrence part, comparing these combinations with a normal list to determine anomalies, using both normal and anomaly methods to enhance detection accuracy.
This approach allows for appropriate detection of anomalies in event occurrences, including partial or out-of-sequence events, by generating and comparing event combinations to a normal list, thereby improving anomaly detection in embedded devices.
Abstract
Description
Anomaly detection device or anomaly detection method
[0001] The present disclosure relates to an anomaly detection device or an anomaly detection method.
[0002] In recent years, with the advent of IoT, various embedded devices have been connected to networks, increasing security risks associated with these devices. As a tool to detect anomalies caused by such security attacks, it has been proposed to introduce an IDS (Intrusion Detection System) into embedded devices.
[0003] In anomaly detection using an IDS, a normal list, which is a list of data that is considered normal, and an abnormal list, which is a list of data that is considered abnormal, are constructed and used for various parameters of events that occur inside a device (such as IP addresses, port numbers, and user IDs). Methods for constructing these lists include a signature method, which is created manually, and an anomaly method, which is automatically generated based on sample data.
[0004] When introducing an IDS into an embedded device with limited resources, a normal list, which is smaller in size if the device's users and usage methods are limited, is considered preferable compared to an abnormal list, which tends to be enormous in size. Furthermore, as a method for constructing lists for embedded devices where environment switching is expected, an anomaly method is considered preferable so that automatic tuning to the environment after the switch is performed. Therefore, technologies for implementing an IDS into embedded devices that realize anomaly detection using the normal list method and the anomaly method have been proposed (e.g., Patent Document 1).
[0005] Patent No. 6984551
[0006] In actual operation, there are cases where processing stops midway, resulting in an anomaly in which an event that should occur only partially occurs, or where an anomaly occurs in which one of multiple events that should occur substantially simultaneously is missing. However, because the events that occur in these anomalies are themselves events that exist in the normal list, there is a problem in that it is difficult to detect these anomalies using a method that determines whether the event that occurred exists in the normal list.
[0007] Therefore, the present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a technology that can appropriately detect abnormalities in the occurrence of an event.
[0008] The anomaly detection device according to the present disclosure includes: a first list generation unit that generates, from an event list group in which a plurality of events are recorded, information including an event that occurred inside a device, parameters of specific content related to the event, and occurrence portions, a first event list group in which two or more events having similar parameters are grouped into each first event list; a second list generation unit that generates, from the first event list group, a second event list group in which two or more events having similar parameters and the same combinations of occurrence portions are grouped into each second event list; an aggregation unit that generates a combination of events for each combination of occurrence portions by aggregating the two or more events in the second event list group into each second event list; a storage unit that accumulates the event combinations extracted based on the generation frequency of the event combinations in a normal list; and a comparison unit that compares the generated event combinations with the event combinations accumulated in the normal list to determine whether the generated event combinations are normal.
[0009] According to the present disclosure, by aggregating two or more events in the second event list group, a combination of events is generated for each combination of occurrence parts, and the generated combination of events is compared with the combination of events stored in the normal list to determine whether the generated combination of events is normal. With this configuration, it is possible to appropriately detect abnormalities in the occurrence of events.
[0010] The objects, features, aspects and advantages of the present disclosure will become more apparent from the following detailed description and the accompanying drawings.
[0011] 1 is a block diagram showing the configuration of an anomaly detection device according to embodiment 1. FIG. 1 is a diagram showing an event list group according to embodiment 1. FIG. 2 is a flowchart showing the processing of a simultaneous collection unit according to embodiment 1. FIG. 2 is a diagram showing an event list group according to embodiment 1. FIG. 3 is a diagram showing a simultaneous event list group according to embodiment 1. FIG. 4 is a flowchart showing the processing of an occurrence portion-specific classification unit according to embodiment 1. FIG. 5 is a diagram showing an occurrence portion list group according to embodiment 1. FIG. 6 is a diagram showing an occurrence portion combined value list according to embodiment 1. FIG. 7 is a diagram showing a simultaneous event list group by occurrence portion according to embodiment 1. FIG. 8 is a flowchart showing the processing of an aggregation unit according to embodiment 1. FIG. 9 is a diagram showing an aggregated list according to embodiment 1. FIG. 10 is a diagram showing an operation mode according to embodiment 1. FIG. 11 is a flowchart showing the processing of an operation switching unit according to embodiment 1. FIG. 12 is a flowchart showing the processing of a storage unit according to embodiment 1. FIG. 13 is a diagram showing a normal candidate list according to embodiment 1. FIG. 14 is a diagram showing a normal list according to embodiment 1. FIG. 15 is a flowchart showing the processing of a collation unit according to embodiment 1. FIG. 16 is a diagram showing an anomaly detection log according to embodiment 1. FIG. 17 is a block diagram showing the hardware configuration of an anomaly detection device according to a modified example. FIG. 18 is a block diagram showing the hardware configuration of an anomaly detection device according to a modified example.
[0012] 1 is a block diagram showing the configuration of an anomaly detection device 101 according to Embodiment 1. The anomaly detection device 101 includes a simultaneous collection unit 103 which is a first list generation unit, an occurrence part classification unit 105 which is a second list generation unit, an aggregation unit 107, an operation switching unit 110, a storage unit 111, and a collation unit 113.
[0013] Event lists 102 in which events are recorded in list format are appropriately input to anomaly detection device 101. As will be described in detail later, the anomaly detection device 101, having received the input, appropriately outputs anomaly detection log 114 indicating the determination result as to whether or not an anomaly has occurred.
[0014] FIG. 2 is a diagram showing an example of the event list group 102. The event list group 102 includes an event list 202, which is a list of multiple events 203. The event 203 is information including an event that occurs within a device, parameters of specific content related to the event, and an occurrence portion. For example, the event 203 may include an IP address 204, which is the occurrence portion, a function 205, which is the event, and a time 206, which is the specific content, as in the upper event list 202. Alternatively, the event 203 may include a UID 207, which is the user ID used by the operating system, a function 205, which is the event, and a time 206, which is the specific content, as in the lower event list 202.
[0015] The occurrence part according to the first embodiment includes IP address 204 and UID 207, but may include any part where an event occurs, such as a port number. The event according to the first embodiment includes function 205 for performing processing within the device, but may include any event that occurs within the device, such as communication and system calls. The specific content according to the first embodiment is time 206, and event 203 dynamically increases as time 206 passes, but is not limited to this.
[0016] 1 generates a simultaneous event list group 104, which is a first event list group, from the event list group 102. In the simultaneous event list group 104, two or more events 203 having similar (approximate) time 206 parameters are grouped together into a simultaneous event list (first event list).
[0017] 3 is a flowchart showing an example of the processing of the simultaneous collection unit 103. In step S1, the simultaneous collection unit 103 compiles all events 203 that have occurred since the previous operation of the simultaneous collection unit 103 from the event list group 102 into one event list by arranging them in order of time 206. The event list obtained in step S1 for the nth operation is used as the current event list for the nth operation, as the previous event list for the (n-1)th operation, and as the event list before the previous one for the (n-2)th operation.
[0018] In step S2, the simultaneous time collection unit 103 generates an event list group in which the event lists for the event before last, the previous event, and the current event are arranged in order. Fig. 4 is a diagram showing an example of the event list group 301 generated in step S2. In the event list group 301 of Fig. 4, an event list 302 for the event before last, a previous event list 303, a current event list 304, and their events 203 are arranged in order of time 206.
[0019] In step S3, the simultaneous time collection unit 103 determines whether the difference in time 206 between any of the events 203 in the event list group 301 generated in step S2 and the event 203 immediately preceding it is equal to or greater than a threshold value. If it is determined that the difference is equal to or greater than the threshold value, the process proceeds to step S4, and if it is determined that the difference is smaller than the threshold value, the process proceeds to step S5.
[0020] In step S4, the simultaneous time collection unit 103 extracts the events 203 for which it is determined that the difference is equal to or greater than the threshold value. Then, the process proceeds to step S5.
[0021] In step S5, the simultaneous time collection unit 103 determines whether or not the processing of step S3 has been performed for all events 203 in the event list group 301. If it is determined that the processing has been performed, the processing proceeds to step S6, and if it is determined that the processing has not been performed, the processing proceeds to step S3.
[0022] In step S6, the simultaneous collection unit 103 extracts a simultaneous event list 305 starting with the event 203 extracted in step S4 from the event list group 301. In the example of Fig. 4, the threshold in step S3 is 40 seconds, and simultaneous event list 305a and simultaneous event lists 305b, 305c, and 305d starting with events 203b, 203c, and 203d, respectively, are extracted. The threshold is an allowable value for the difference in time 206 of events 203 extracted in the same simultaneous event list 305, and may be adjusted as appropriate by, for example, the user.
[0023] In step S7, if the first event 203 in the simultaneous event list 305 is included in the previous event list 303, the simultaneous collection unit 103 includes the simultaneous event list 305 in the current simultaneous event list group 104.
[0024] Fig. 5 is a diagram showing an example of the simultaneous event list group 104 generated by the process of Fig. 3. When the event list group 301 of Fig. 4 is generated in step S2, the first events 203b and 203c of the simultaneous event lists 305b and 305c are included in the previous event list 303. In such a case, the simultaneous collection unit 103 includes the simultaneous event lists 305b and 305c in the current simultaneous event list group 104, as shown in Fig. 5.
[0025] The classification unit 105 by occurrence part in FIG. 1 generates a second event list group, a simultaneous event list group by occurrence part 106, from the simultaneous event list group 104. In the simultaneous event list group by occurrence part 106, two or more events 203 having similar time 206 parameters and the same combination of occurrence parts are grouped together in each simultaneous event list by occurrence part (second event list). In the first embodiment, the combination of occurrence parts is a combination of an IP address 204 and a UIS 207, but this is not limited thereto and may be, for example, either one of the IP address 204 and the UIS 207.
[0026] 6 is a flowchart showing an example of the processing of the occurrence part classification unit 105. In step S11, the occurrence part classification unit 105 generates an occurrence part list group in which possible values of the occurrence part (e.g., IP address 204 and UID 207) are compiled into an occurrence part list for any of the simultaneous event lists 305 in the simultaneous event list group 104. FIG. 7 is a diagram showing an example of the occurrence part list group 401 generated in step S11. The occurrence part list group 401 in FIG. 7 includes an occurrence part list 402a in which possible values of the IP address 204 are compiled, and an occurrence part list 402b in which possible values of the UID 207 are compiled.
[0027] In step S12, the occurrence part classification unit 105 cross-links the occurrence part lists including occurrence parts present in one event 203 of the simultaneous event list group 104 with the occurrence part lists not including occurrence parts present in the one event 203. At this time, the occurrence part classification unit 105 complements the occurrence parts of the one event 203 so that the one event 203 has all occurrence parts. The occurrence part classification unit 105 performs this complementation for each event 203 in the simultaneous event list group 104, and compiles the obtained events 203 into a single event list.
[0028] In step S13, the occurrence part classification unit 105 extracts all combinations of occurrence parts (e.g., IP addresses 204 and UIDs 207) from the obtained event list to generate an occurrence part combination value list. Figure 8 is a diagram showing an example of the occurrence part combination value list 403 generated in step S13. The occurrence part combination value list 403 in Figure 8 includes combinations of IP addresses 204 "10.20.30.01" and "10.20.30.02" and UIDs 207 "U1" and "U2".
[0029] In step S14, the occurrence part classification unit 105 classifies the events 203 into occurrence part simultaneous event lists 404 corresponding to the combinations of occurrence parts in the occurrence part combination value list 403, and generates a group of occurrence part simultaneous event lists 106.
[0030] In step S15, the occurrence part classification unit 105 determines whether or not the processes of steps S11 to S14 have been performed for all simultaneous event lists 305 in the simultaneous event list group 104. If it is determined that the processes have been performed, the process of FIG. 6 ends, and if it is determined that the processes have not been performed, the process proceeds to step S11.
[0031] Fig. 9 is a diagram showing an example of the simultaneous event list group 106 by occurrence part generated by the process of Fig. 6. In the simultaneous event list group 106 by occurrence part in Fig. 9, the events 203 classified by time 206 in Fig. 5 are classified by combination of IP address 204 and UID 207 and by simultaneous event list 404 by occurrence part corresponding to the time 206.
[0032] 1 generates an aggregated list 108 from the group of simultaneous event lists by occurrence part 106 by aggregating two or more events 203 in the group of simultaneous event lists by occurrence part 106 into a simultaneous event list by occurrence part 404. The aggregated list 108 includes combinations of events (e.g., functions 205) for each combination of occurrence parts (e.g., IP addresses 204 and UIDs 207).
[0033] 10 is a flowchart showing an example of the processing of the aggregation unit 107. In step S21, the aggregation unit 107 checks two or more events 203 for any parameter (e.g., IP address 204, function 205, time 206, and UID 207) in the event 203 in any of the occurrence-part-specific simultaneous event lists 404. The aggregation unit 107 then determines whether the parameters of two or more events 203 contain the same character string. If it is determined that the same character string is included, the processing proceeds to step S22, and if it is determined that the same character string is not included, the processing proceeds to step S23.
[0034] In step S22, the aggregation unit 107 removes duplicates of the same multiple character strings and aggregates them into a single character string. Then, the process proceeds to step S24. In step S23, the aggregation unit 107 combines different character strings. Then, the process proceeds to step S24.
[0035] In step S24, the aggregation unit 107 determines whether the processing of step S21 has been performed for all parameters. If it is determined that the processing has been performed, the processing proceeds to step S25, and if it is determined that the processing has not been performed, the processing proceeds to step S21.
[0036] In step S25, the aggregation unit 107 determines whether the processing of step S21 has been performed for all occurrence-part simultaneous event lists 404. If it is determined that the processing has been performed, the processing of Fig. 10 ends, and if it is determined that the processing has not been performed, the processing proceeds to step S21. Through the above processing, a combination of functions 205 for each combination of occurrence parts and time 206 is generated.
[0037] Fig. 11 is a diagram showing an example of the aggregated list 108 generated by the process of Fig. 10. The first line of the aggregated list 108 in Fig. 11 shows the result of aggregating the four events 203 in the first simultaneous event list by occurrence part 404 from the top in Fig. 9. In the first simultaneous event list by occurrence part 404 from the top in Fig. 9, duplicates of the IP addresses 204, UIDs 207, and times 206 of the four events 203 have been deleted, and the character strings "F1", "F2", "F5", and "F6" of the functions 205 of the four events 203 have been combined using "," as a separator.
[0038] When the order of string combination is used as the order in the original event list group 102, it is possible to realize anomaly detection that takes the order into consideration for events that should occur almost simultaneously. When the order of string combination is always used as the order sorted according to a fixed rule, regardless of the original event list group 102, it is possible to realize anomaly detection that does not take the order into consideration for events that should occur almost simultaneously.
[0039] The operation switching unit 110 in FIG. 1 executes at least one of the storage unit 111 and the collation unit 113, which will be described later, based on the operation mode 109. In this specification, for example, at least one of A, B, C, ..., and Z means any one of all combinations of one or more types extracted from the group of A, B, C, ..., and Z. FIG. 12 is a diagram showing an example of the operation mode 109. The operation mode 109 is set to one of "storage," "collation," and "both," for example, by a user operation, and in the example of FIG. 12, "both" is set as the operation mode 109.
[0040] 13 is a flowchart showing an example of processing by the operation switching unit 110. In step S31, the operation switching unit 110 determines whether the operation mode 109 is "storage," "collation," or "both." If the operation mode 109 is "storage," the processing proceeds to step S32; if the operation mode 109 is "collation," the processing proceeds to step S33; and if the operation mode 109 is "both," the processing proceeds to steps S32 and S33.
[0041] In step S32, the operation switching unit 110 outputs the aggregated list 108 generated by the aggregation unit 107 to the storage unit 111, thereby causing the storage unit 111 to execute. After that, the processing in FIG. 13 ends.
[0042] In step S33, the operation switching unit 110 outputs the aggregated list 108 generated by the aggregation unit 107 to the collation unit 113, thereby causing the collation unit 113 to execute the collation. After that, the processing in FIG. 13 ends.
[0043] The accumulation unit 111 in FIG. 1 accumulates, in a normal list 112, combinations of events extracted based on the frequency of occurrence of combinations of events in the aggregated list 108.
[0044] 14 is a flowchart showing an example of processing by the storage unit 111. In step S41, the storage unit 111 determines whether or not any combination of events in the aggregated list 108 output from the operation switching unit 110 exists in the normal candidate list. If it is determined that the combination of events exists in the normal candidate list, the processing proceeds to step S42, and if it is determined that the combination of events does not exist in the normal candidate list, the processing proceeds to step S43.
[0045] In step S42, the accumulation unit 111 increments the occurrence frequency of the combination of events determined to be present in the normal candidate list, and then the process proceeds to step S44.
[0046] In step S43, the accumulation unit 111 adds the combination of events determined to be present in the normal candidate list to the normal candidate list, and then the process proceeds to step S44.
[0047] 15 is a diagram showing an example of a normal candidate list 501. The normal candidate list 501 in Fig. 15 includes event parameters 502 and generation frequencies 503 of combinations of functions 205, and the event parameters 502 include combinations of IP addresses 204 and UIDs 207, and combinations of functions 205. The generation frequencies 503 may be the number of occurrences, or may be a value obtained by dividing the number of occurrences by the elapsed time.
[0048] In step S44, the accumulation unit 111 determines whether or not the processing of step S41 has been performed for all combinations of events in the aggregated list 108 output from the operation switching unit 110. If it is determined that the processing has been performed, the processing proceeds to step S45, and if it is determined that the processing has not been performed, the processing proceeds to step S41.
[0049] In step S45, the accumulation unit 111 accumulates, among the event parameters 502 in the normal candidate list 501, the event parameters 502 whose generation frequency 503 is equal to or greater than a threshold value, in the normal list 112. Fig. 16 is a diagram showing an example of the normal list 112. The normal list 112 in Fig. 16 includes the event parameters 502 in the normal candidate list 501 in Fig. 15 whose generation frequency 503 exceeds 100.
[0050] The collation unit 113 in FIG. 1 compares the newly generated event combination in the aggregation unit 107 with the event combinations accumulated in the normality list 112, determines whether the newly generated event combination is normal, and outputs an abnormality detection log 114 indicating the determination result.
[0051] 17 is a flowchart showing an example of processing by the collation unit 113. In step S51, the collation unit 113 determines whether any combination of events in the aggregated list 108 output from the operation switching unit 110 exists in the normal list 112. For example, the collation unit 113 determines that a combination of events exists in the normal list 112 when the character strings of the combination of occurrence portions completely match and the character strings of the combination of events completely match in the aggregated list 108 and the normal list 112. If it is determined that the combination of events exists, the processing proceeds to step S53, and if it is determined that the combination of events does not exist, the processing proceeds to step S52.
[0052] In step S52, the collation unit 113 outputs the abnormality detection log 114 indicating the event 203 in the aggregated list 108. Thereafter, the process proceeds to step S53.
[0053] FIG. 18 is a diagram illustrating an example of the anomaly detection log 114. FIG. 18 illustrates a case in which the aggregated list 108 includes a combination of functions 205, "F1," "F2," and "F5," for a combination of an IP address 204 of "10.20.30.01" and a UID 207 of "U1." The combination of functions 205 in this aggregated list 108 lacks a function 205, "F6," compared to the combination of functions 205 for the combination of the IP address 204 of "10.20.30.01" and the UID 207 of "U1" in the normal list 112 of FIG. 16 . In this case, the collation unit 113 outputs the anomaly detection log 114 indicating the combination of functions 205, "F1," "F2," and "F5," and the time 206, for the combination of the IP address 204 of "10.20.30.01" and the UID 207 of "U1."
[0054] 18 , an event of function 205 "F6" occurs after the threshold value of time 206, which is regarded as almost simultaneous, has passed after the events of functions 205 "F1," "F2," and "F5" have occurred. In this case, the event of function 205 "F6" is not aggregated with the events of functions 205 "F1," "F2," and "F5." As a result, an abnormality is detected not only for the events of functions 205 "F1," "F2," and "F5," but also for the event of function 205 "F6."
[0055] In step S53, the collation unit 113 determines whether or not the processing of step S51 has been performed for all combinations of events in the aggregated list 108. If it is determined that the processing has been performed, the processing of FIG. 17 ends, and if it is determined that the processing has not been performed, the processing proceeds to step S51.
[0056] Summary of First Embodiment According to the anomaly detection device 101 of the first embodiment described above, the aggregating unit 107 generates a combination of events for each combination of occurrence parts by aggregating two or more events 203 in the simultaneous event lists by occurrence part 106 into each simultaneous event list by occurrence part 404, the accumulating unit 111 accumulates the event combinations extracted based on the generation frequency of the event combinations in the normal list 112, and the comparing unit 113 compares the generated event combination with the event combinations accumulated in the normal list 112 to determine whether the generated event combination is normal. With this configuration, an anomaly detection device using the normal list method and the anomaly method can detect an anomaly in which an event that should occur only occurs partway through, or an anomaly in which any of multiple events that should occur substantially simultaneously is missing.
[0057] 1 , the simultaneous collection unit 103, the occurrence part classification unit 105, the aggregation unit 107, the operation switching unit 110, the accumulation unit 111, and the collation unit 113 will be hereinafter referred to as the "simultaneous collection unit 103, etc." The simultaneous collection unit 103, etc. is realized by a processing circuit 81 shown in FIG. That is, the processing circuit 81 includes a simultaneous collection unit 103 that generates a simultaneous event list group 104 from the event list group 102, a classification unit by occurrence part 105 that generates a simultaneous event list group by occurrence part 106 from the simultaneous event list group 104, an aggregation unit 107 that generates a combination of events for each combination of occurrence parts by aggregating two or more events in the simultaneous event list group by occurrence part 106, a storage unit 111 that stores the event combinations extracted based on the generation frequency of the event combinations in a normal list 112, a comparison unit 113 that compares the generated event combination with the event combinations accumulated in the normal list 112 to determine whether the generated event combination is normal, and an operation switching unit 110 that executes at least one of the storage unit 111 and the comparison unit 113 based on an operation mode. The processing circuit 81 may be implemented by dedicated hardware or by a processor that executes a program stored in a memory. Examples of processors include central processing units, processing units, arithmetic units, microprocessors, microcomputers, and DSPs (Digital Signal Processors).
[0058] When the processing circuit 81 is dedicated hardware, the processing circuit 81 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these. The functions of each unit such as the simultaneous collection unit 103 may be realized by a circuit in which processing circuits are distributed, or the functions of each unit may be realized together by a single processing circuit.
[0059] When the processing circuit 81 is a processor, the functions of the simultaneous collection unit 103 and the like are realized in combination with software, etc. Note that software, etc., includes, for example, software, firmware, or software and firmware. The software, etc. is written as a program and stored in memory. As shown in FIG. 20 , the processor 82 applied to the processing circuit 81 realizes the functions of each unit by reading and executing the program stored in the memory 83. That is, the anomaly detection device 101 includes a memory 83 for storing a program that, when executed by the processing circuitry 81, results in the following steps: generating a simultaneous event list group 104 from the event list group 102, generating a simultaneous event list group by occurrence portion 106 from the simultaneous event list group 104, generating a combination of events for each combination of occurrence portions by aggregating two or more events from the simultaneous event list group by occurrence portion 106, storing the event combinations extracted based on the frequency of generation of the event combinations in a normal list 112, comparing the generated event combinations with the event combinations stored in the normal list 112 to determine whether the generated event combinations are normal, and executing at least one of the storing and comparing based on the operating mode. In other words, this program can be said to cause a computer to execute the procedures and methods of the simultaneous collection unit 103, etc. Here, the memory 83 may be, for example, a non-volatile or volatile semiconductor memory such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Memory), or an EEPROM (Electrically Erasable Programmable Read Only Memory), a HDD (Hard Disk Drive), a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), a drive device for any of these, or any storage medium to be used in the future.
[0060] The above describes a configuration in which each function of the simultaneous time collection unit 103 and the like is realized either by hardware or software, etc. However, this is not limited to this, and a configuration in which part of the simultaneous time collection unit 103 and the like is realized by dedicated hardware and another part is realized by software, etc. For example, the function of the simultaneous time collection unit 103 can be realized by the processing circuit 81 as dedicated hardware, and the other functions can be realized by the processing circuit 81 as the processor 82 reading and executing programs stored in the memory 83.
[0061] As described above, the processing circuitry 81 can realize the above-described functions by hardware, software, or a combination of these.
[0062] The anomaly detection device described above can also be applied to an anomaly detection system constructed as a system by appropriately combining a processing device and a server. The functions or components of the anomaly detection device described above may be distributed among the devices that construct the system, or may be concentrated in one of the devices.
[0063] In this disclosure, 'a' and 'an' mean one or more. Therefore, 'a', 'an', 'one or more', and 'at least one' can be used interchangeably.
[0064] The contents of the embodiments can be modified or omitted as appropriate. The above description is illustrative in all respects and is not limiting. It is understood that countless variations not illustrated can be envisioned.
[0065] 101 Anomaly detection device, 102 Event list group, 103 Simultaneous collection unit, 104 Simultaneous event list group, 105 Classification unit by occurrence part, 106 Simultaneous event list group by occurrence part, 107 Aggregation unit, 110 Operation switching unit, 111 Accumulation unit, 112 Normal list, 113 Collation unit, 203 Event, 204 IP address, 205 Function, 206 Time, 207 UID, 305 Simultaneous event list, 404 Simultaneous event list by occurrence part.
Claims
1. An anomaly detection device comprising: a first list generation unit that generates a first event list group from an event list group in which a plurality of events are recorded, the first event list group being a group of two or more events with similar parameters, each group consisting of a first event list; a second list generation unit that generates a second event list group from the first event list group being a group of two or more events with similar parameters and the same combination of occurrence parts, each group consisting of a second event list; an aggregation unit that generates a combination of events for each combination of occurrence parts by aggregating the two or more events in the second event list group into each second event list; a storage unit that accumulates the event combinations extracted based on the occurrence frequency of the event combinations in a normal list; and a comparison unit that compares the generated event combinations with the event combinations accumulated in the normal list to determine whether the generated event combinations are normal.
2. An anomaly detection device according to claim 1, further comprising an operation switching unit that executes at least one of the storage unit and the matching unit based on an operation mode.
3. An anomaly detection device according to claim 1 or claim 2, wherein the specific content is time.
4. An anomaly detection method comprising: generating a first event list group from an event list group in which a plurality of events, each of which is information including an event that occurred inside a device and parameters and occurrence parts of specific content related to the event, grouping two or more of the events with similar parameters into a first event list; generating a second event list group from the first event list group, grouping two or more of the events with similar parameters and the same combination of occurrence parts into a second event list; generating a combination of events for each combination of occurrence parts by aggregating the two or more events in the second event list group into each second event list; storing the event combinations extracted based on the frequency of generation of the event combinations in a normal list; and comparing the generated event combinations with the event combinations stored in the normal list to determine whether the generated event combinations are normal.