Information processing method, information processing device, and program

Abstract

An information processing method according to one embodiment of the present disclosure is executed by a computer, the information processing method comprising: acquiring one or more abnormality assessment rules used for assessing abnormality of a log for an apparatus (S10), each of the one or more abnormality assessment rules including a prescribed condition in which one or more items among a plurality of items included in the log for the apparatus are used; determining a degree of priority for each of the plurality of items on the basis of the acquired one or more abnormality assessment rules (S20), the degrees of priority being used for determining an item to be included in a first log transmitted to an analysis device that performs abnormality assessment, from among the plurality of items; and outputting the determined degrees of priority (S30).

Description

Information processing method, information processing device, and program

[0001] The present disclosure relates to an information processing method, an information processing device, and a program.

[0002] In recent years, as control systems such as factories, buildings, and power systems have become increasingly IoT (Internet of Things), cyberattacks have also increased. Countermeasures against cyberattacks are often taken for general IT (Internet Technology) devices by installing security software such as EDR (Endpoint Detection and Response) in the IT devices. However, such countermeasures are difficult for IoT devices, which do not have as many resources as IT devices. Therefore, as a countermeasure against cyberattacks for IoT devices, the IoT devices often transmit their own logs to an external analysis device such as a cloud, which then analyzes the logs. Examples of external analysis devices include SIEM (Security Information Event Management) and EDR. These analysis devices collect logs from various devices and analyze them in an integrated manner to detect abnormalities such as cyber attacks.

[0003] In a control system in which many IoT devices are introduced, the amount of log data (also simply referred to as log volume) that the control system transmits to an external analysis device becomes enormous in proportion to the number of IoT devices included in the control system. However, an increase in the amount of logs transmitted from the IoT devices can lead to a strain on communication bandwidth and to increased costs due to the need to collect and analyze a huge amount of log data using an external analysis device. Therefore, it is necessary to reduce the amount of logs transmitted by the IoT devices while maintaining the analysis accuracy of the external analysis device.

[0004] For example, Patent Literature 1 discloses a method in which an external device shares rules with an IoT device in advance, and if a log matches the rule, the IoT device transmits the log that matches the rule to the external device. According to the method disclosed in Patent Literature 1, the transmission of logs by the IoT device can be minimized, thereby reducing the amount of logs transmitted from the IoT device.

[0005] International Publication No. 2021 / 171390

[0006] According to the method disclosed in Patent Document 1, by sharing log transmission rules that indicate conditions for communication data to be included in logs that IoT devices transmit to external devices, the IoT devices can use the log transmission rules to transmit only logs that are optimal for an analysis device to analyze anomalies, thereby reducing the amount of logs transmitted by IoT devices.

[0007] However, in order for an IoT device to transmit optimal logs using the log transmission rules, log transmission rules tailored to the analysis device are required. Possible methods for the IoT device to use such log transmission rules include a method in which an administrator updates the log transmission rules, or a method in which multiple predefined log transmission rules are switched depending on the state of the IoT device. However, with these methods, there is a possibility that the log transmission rules used by the IoT device will not be optimally set, for example, in cases where the state of the IoT device cannot be clearly defined.

[0008] Furthermore, in an analysis device such as a SIEM, the anomaly detection rules (anomaly detection rules) used by the analysis device also increase or decrease because the anomalies to be detected vary depending on the environment of the IoT device. However, in order for the IoT device to send logs optimized for anomaly detection by the analysis device, each time the anomaly detection rules used by the analysis device are increased or decreased, the administrator must manually update the log transmission rules accordingly. Such updates require a large amount of work for the administrator and are not practical.

[0009] Therefore, an object of the present disclosure is to reduce the amount of log data sent to an analysis device while maintaining the accuracy of log analysis by the analysis device.

[0010] An information processing method according to one aspect of the present disclosure is an information processing method executed by a computer, which acquires one or more abnormality determination rules used to determine an abnormality in an equipment log, each of the one or more abnormality determination rules including a predetermined condition in which one or more items included in the equipment log are used, determines a priority of each of the multiple items based on the one or more acquired abnormality determination rules, the priority being a degree used to determine which of the multiple items to include in a first log that is sent to an analytical device that performs the abnormality determination, and outputs the determined priority.

[0011] Moreover, an information processing device according to one aspect of the present disclosure includes an acquisition unit that acquires one or more abnormality determination rules used to determine an abnormality in a device log; each of the one or more abnormality determination rules includes a predetermined condition in which one or more items included in the device log are used; a determination unit that determines a priority of each of the multiple items based on the one or more acquired abnormality determination rules; and an output unit that outputs the determined priority, the priority being a degree used to determine which of the multiple items are to be included in a first log that is to be transmitted to an analytical device that performs the abnormality determination.

[0012] Furthermore, a program according to one aspect of the present disclosure is a program for causing a computer to execute an information processing method, which includes acquiring one or more abnormality determination rules used to determine an abnormality in a device log, each of the one or more abnormality determination rules including a predetermined condition in which one or more items among a plurality of items included in the device log are used, determining a priority of each of the plurality of items based on the one or more acquired abnormality determination rules, the priority being a degree for determining which of the plurality of items are to be included in a first log that is transmitted to an analytical device that performs the abnormality determination, and outputting the determined priority.

[0013] According to the present disclosure, it is possible to reduce the amount of log data transmitted to an analysis device while maintaining the accuracy of log analysis by the analysis device.

[0014] FIG. 1 is a diagram showing the overall configuration of a log priority calculation system according to this embodiment. FIG. 2 is a diagram showing the overall configuration of a log analysis system according to this embodiment. FIG. 3 is a diagram showing an example of a flowchart of an abnormality determination process according to this embodiment. FIG. 4 is a diagram showing an example of device data according to this embodiment. FIG. 5 is a diagram showing an example of an abnormality determination rule used in the abnormality determination unit according to this embodiment. FIG. 6 is a diagram showing an example of an abnormality determination result according to this embodiment. FIG. 7 is a diagram showing an example of a flowchart of a missing column acquisition process according to this embodiment. FIG. 8 is a diagram showing an example of a flowchart of a log priority update process according to this embodiment. FIG. 9 is a diagram showing a column list stored in the log priority storage unit according to this embodiment. FIG. 10 is a diagram showing an example of a flowchart of a log priority calculation process according to this embodiment. FIG. 11 is a diagram showing an example of a log priority determination process using an abnormality determination result according to this embodiment. FIG. 12 is a diagram showing an example of a flowchart of a log priority calculation process using an abnormality determination rule according to a first modification of this embodiment. FIG. 13 is a diagram showing an example of a log priority determination process using an abnormality determination rule according to the first modification of this embodiment. FIG. 14 is a diagram showing an example of a flowchart of a log priority calculation process according to a second modification of this embodiment. FIG. 15 is a diagram showing an example of the total amount of data for each column for a predetermined period according to the second modification of this embodiment. Fig. 16 is a diagram showing an example of a log priority determination process using the total amount of data for each column in Modification 2 of this embodiment. Fig. 17 is a flowchart showing an information processing method in this embodiment.

[0015] (Knowledge forming the basis of the present disclosure) As IoT advances in the field of control systems for factories, buildings, power systems, etc., there are an increasing number of cases in which control system networks are connected to the Internet for convenience and efficiency reasons. As a result, the risk of cyber attacks is increasing for control systems, just like for IT systems, and the introduction of security measures for control systems has become an urgent issue.

[0016] Because control systems place the utmost importance on system availability, it is not easy to implement common security measures such as antivirus software or security patches, which can affect availability. For this reason, control systems often passively collect communication logs between devices and send them to an analysis device such as a SIEM, which centrally collects and manages the logs and monitors for signs of cyber attacks.

[0017] Furthermore, as cyberattacks become more sophisticated, general security measures such as installing antivirus software or applying security patches are no longer sufficient in IT environments. As a result, the introduction of EDR, which aims to prevent damage by quickly detecting and responding to the assumption that an attacker has infiltrated an internal system through a cyberattack, is becoming more common.

[0018] In systems that use EDR, an agent is installed inside the monitored device, and the logs (log data) of the monitored device are sent to a server installed in the cloud, etc. With this configuration, log analysis is often performed in an integrated manner within the server.

[0019] In an analysis device such as an SIEM or EDR, anomaly detection rules for analyzing communication logs between devices and internal device logs to detect anomalies change over time due to changes in events to be detected or changes in trends in cyber attacks. Therefore, the device transmits as many acquired logs as possible to the analysis device so that it can also detect anomalies using the changed anomaly detection rules.

[0020] When the amount of communication between devices is huge or when there are a large number of devices, the amount of logs sent to the analyzer becomes enormous, which may increase the cost of abnormality detection and strain the communication bandwidth. However, if the device makes a mistake in selecting the logs to be sent, the accuracy of the abnormality detection by the analyzer may decrease, so it is not easy to reduce the amount of logs sent from the device to the analyzer while maintaining the accuracy of abnormality detection.

[0021] Therefore, the information processing method of Example 1 is an information processing method executed by a computer, which acquires one or more abnormality determination rules used to determine abnormalities in an equipment log, each of the one or more abnormality determination rules including a predetermined condition in which one or more items out of a plurality of items included in the equipment log are used, determines a priority of each of the plurality of items based on the acquired one or more abnormality determination rules, the priority being a degree used to determine which of the plurality of items to include in a first log that is sent to an analytical device that performs the abnormality determination, and outputs the determined priority.

[0022] This makes it possible to output an optimal priority (also referred to as a log priority) according to the content of the anomaly determination rule used for anomaly determination in the analytical device. For example, the priority is output to an apparatus (also referred to as an IoT apparatus). Based on the output priority, the apparatus can include in a log (first log) items necessary for anomaly determination by the analytical device, from among multiple items contained in the apparatus's log (also referred to as apparatus data), and transmit the log. This makes it possible to reduce the amount of log data transmitted without reducing the accuracy of anomaly determination by the analytical device. In other words, the information processing method of Example 1 makes it possible to reduce the amount of log data transmitted to the analytical device while maintaining the accuracy of log analysis by the analytical device.

[0023] The information processing method of Example 2 is the information processing method of Example 1, and the log of the device may be a communication log of the device or an operation log of the device.

[0024] This allows the analysis device to determine whether there is an abnormality in the communication log or operation log of the device.

[0025] The information processing method of Example 3 is the information processing method of Example 1 or Example 2, further comprising storing the determined priorities, determining the priorities for each predetermined first period, and outputting the priorities when there is a change in any of the determined priorities for each of the plurality of items from the stored priorities for each of the plurality of items.

[0026] According to this, the log priority can be output only when the priority has changed, so that the amount of communication with the information processing device that executes the information processing method of Example 3 can be reduced.

[0027] The information processing method of Example 4 is the information processing method of Example 3, and in outputting the priorities, only the priorities of the determined items that have changed from the priorities of the stored items may be output.

[0028] This makes it possible to further reduce the amount of communication between the device and the information processing device that executes the information processing method of Example 4.

[0029] The information processing method of Example 5 is any of the information processing methods of Examples 1 to 4, and may further store the one or more acquired abnormality determination rules, and the priority determination may be performed when there is a change in at least a portion of the one or more re-acquired abnormality determination rules from the one or more stored abnormality determination rules.

[0030] According to this, when the abnormality determination rule is changed, a priority corresponding to the change in the abnormality determination rule can be output, which allows the accuracy of abnormality determination in the analyzer to be maintained and reduces the amount of communication between the analyzer and the information processing device that executes the information processing method of Example 5.

[0031] The information processing method of Example 6 is any of the information processing methods of Examples 1 to 5, and the priority may be one of at least two levels, including a level indicating that each of the plurality of items should be included in the first log and a level indicating that each of the plurality of items should not be included in the first log.

[0032] This allows the device to prioritize items that have a set priority as a degree of inclusion in the log and send them in the first log, thereby reducing the amount of logs sent while maintaining the accuracy of abnormality detection in the analysis device.

[0033] The information processing method of Example 7 is the information processing method of Example 6, and in determining the priority, the priority of at least one item among the one or more items used in the predetermined condition included in each of the one or more acquired abnormality determination rules may be determined to a degree that indicates inclusion in the first log.

[0034] This allows the device to send the first log containing only the minimum number of items necessary to perform abnormality determination using each abnormality determination rule, thereby reducing the amount of data (log volume) in the first log that the device sends to the analytical device.

[0035] The information processing method of Example 8 is the information processing method of Example 6 or Example 7, wherein the analysis device classifies the first logs into a plurality of groups using predetermined items, performs the abnormality determination for each group, and determines the priority such that the priority of the predetermined items indicates that the first logs should be included in the first log.

[0036] This allows the device to send only the minimum number of items required for abnormality determination in the first log, thereby reducing the amount of logs sent by the device to the analyzer.

[0037] The information processing method of Example 9 is any of the information processing methods of Examples 1 to 8, and may further include obtaining a determination result of the abnormality determination of the first log executed using the one or more abnormality determination rules, and determining the priority based on the determination result.

[0038] This allows the analysis device to determine and output a priority corresponding to the change in the trend of cyber attacks or the tendency of logs over time, based on the result of the anomaly determination, thereby maintaining the accuracy of the anomaly determination.

[0039] An information processing method of Example 10 is the information processing method of Example 9, wherein the determination result includes one or more results obtained by determining whether or not each of the one or more items to be included in the first log satisfies the specified condition included in each of the one or more anomaly determination rules, and the priority determination may include calculating a match rate, which is the proportion of the one or more results that are determined to satisfy the specified condition, for each of the one or more items, and determining the priority such that an item with a lower match rate among the one or more items is more likely to be indicated for inclusion in the first log.

[0040] The analytical device may request the equipment to transmit additional information if the first log does not contain an item that satisfies a predetermined condition included in the anomaly determination rule, in other words, a predetermined condition set by the anomaly determination rule. Therefore, according to the information processing method of Example 10, the equipment can prioritize items with a low match rate, i.e., items that are unlikely to satisfy the predetermined condition set by the anomaly determination rule, in the first log and transmit them. This reduces the number of times the analytical device requests the equipment to transmit additional information, thereby reducing the amount of communication between the equipment and the analytical device.

[0041] An information processing method of Example 11 is the information processing method of any of Examples 1 to 8, wherein the one or more abnormality determination rules are a plurality of abnormality determination rules, and the priority determination may involve calculating a usage rate, which is the proportion of abnormality determination rules that use each of the plurality of items among the plurality of abnormality determination rules, for each of the plurality of items, and determining the priority such that an item with a higher usage rate among the plurality of items is more likely to be indicated as being included in the first log.

[0042] The analytical device may request the equipment to transmit additional information if an item defined as a target of a predetermined condition in an anomaly determination rule is not included in the first log. Therefore, according to the information processing method of Example 11, the equipment can prioritize items with high usage rates, i.e., items defined as a target of a predetermined condition in more anomaly determination rules, to be included in the first log and transmitted. This reduces the number of times the analytical device requests the equipment to transmit additional information, thereby reducing the amount of communication between the equipment and the analytical device.

[0043] The information processing method of Example 12 is any of the information processing methods of Examples 1 to 8, and further includes acquiring a second log containing all of the plurality of items for each predetermined second period, and determining the priority based on the total amount of data for each of the plurality of items contained in the acquired second log.

[0044] This allows the device to prioritize items with a smaller total data volume among multiple items included in the device log (i.e., the log recorded by the device) and transmit them as the first log, thereby reducing the data volume (total capacity) of the first log to be transmitted.

[0045] The information processing device of Example 13 includes an acquisition unit that acquires one or more abnormality determination rules used to determine an abnormality in a device log, each of the one or more abnormality determination rules including a predetermined condition using one or more items among a plurality of items included in the device log, a determination unit that determines a priority of each of the plurality of items based on the one or more acquired abnormality determination rules, and an output unit that outputs the determined priority, the priority being a degree used to determine which of the plurality of items is to be included in a first log that is to be transmitted to an analytical device that performs the abnormality determination.

[0046] According to this, the information processing device can output to the device an optimal priority according to the content of the abnormality determination rule used for abnormality determination in the analyzer. Based on the output priority, the device can include items necessary for abnormality determination by the analyzer from among multiple items included in the device log in a first log and transmit the first log to the analyzer. Therefore, the information processing device can reduce the amount of log data transmitted to the analyzer while maintaining the accuracy of log analysis by the analyzer.

[0047] The program of Example 14 is a program for causing a computer to execute an information processing method, which acquires one or more abnormality determination rules used to determine an abnormality in an equipment log, each of the one or more abnormality determination rules including a predetermined condition using one or more items out of a plurality of items included in the equipment log, determines a priority of each of the plurality of items based on the one or more acquired abnormality determination rules, the priority being a degree for determining which of the plurality of items are to be included in a first log that is transmitted to an analytical device that performs the abnormality determination, and outputs the determined priority.

[0048] This allows the analyzer to output an optimal priority according to the content of the anomaly determination rule used for anomaly determination. Based on the output priority, the analyzer can include, in the first log, items necessary for anomaly determination by the analyzer, among multiple items included in the log of the analyzer, and transmit the first log. Therefore, the computer that executes the program of Example 14 can reduce the amount of log data transmitted to the analyzer while maintaining the accuracy of log analysis by the analyzer.

[0049] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Each of the embodiments described below represents a specific example of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in independent claims will be described as optional components. Furthermore, the respective contents of all the embodiments and modified examples can be combined.

[0050] In addition, the same reference numerals are used for the same components in each drawing.

[0051] Furthermore, in this specification, ordinal numbers such as "first" and "second" do not refer to the number or order of components unless otherwise specified, but are used for the purpose of avoiding confusion and distinguishing between components of the same type.

[0052] Furthermore, in this specification, when a comparison is made, for example, with "above a threshold" or "below a threshold," it means that the distinction is made at the threshold, and may mean "greater than the threshold" or "below the threshold," respectively.

[0053] Furthermore, the numerical values ​​of the thresholds and the like in the present embodiment are merely examples, and other numerical values ​​may be used.

[0054] (Embodiment) [Overall Configuration] FIG. 1 is a diagram showing the overall configuration of an example of a log priority calculation system 10 according to this embodiment.

[0055] The log priority calculation system 10 is a system that analyzes logs transmitted from devices such as IoT devices based on log priorities (also simply referred to as priorities) and notifies a user of the analysis results. The log priority calculation system 10 includes, for example, a device group 120 and a log analysis system 400.

[0056] The device group 120 includes one or more devices such as IoT devices. For example, the device group 120 is arranged at a site 110, which is a building such as a factory or a building. In other words, the device group 120, which is made up of a plurality of devices, exists at the site 110. The devices included in the device group 120 may be any device, and may be, for example, various devices such as OA (Office Automation) devices in an IT environment, controllers in a control system environment, or IP cameras (network cameras).

[0057] Each of the multiple devices included in the device group 120 (hereinafter simply referred to as the device group 120) transmits logs (also referred to as device data) such as its own internal log (i.e., a processing log indicating processes executed by the device itself) and communication data (also referred to as a communication log) between devices that have communicated with other devices as logs 501 to the log analysis system 400. Specifically, each device included in the device group 120 records information indicating its own operation, etc. as device data, and transmits at least a portion of the recorded device data to the log analysis system 400 as log 501. The device data is an example of a device log, and the log 501 is an example of a first log. For example, the device log (device data) is a device communication log or a device operation log.

[0058] When devices included in the device group 120 communicate with each other, only one of the devices involved in the communication may transmit a communication log to the log analysis system 400 as the log 501. Also, each device may transmit only the communication log transmitted to another device or the communication log received from another device as the log 501. Also, any one of the multiple devices included in the device group 120 may collect the logs 501 of each device and transmit the collected log 501 to the log analysis system 400 on behalf of the device group 120.

[0059] The log analysis system 400 is a system that analyzes a log 501 transmitted from the device group 120. The log analysis system 400 includes an anomaly detection device 200 and a log priority calculation device 300.

[0060] The anomaly detection device 200 is a computer that receives a log 501 transmitted from the device group 120 and performs an anomaly determination (anomaly determination process) on the received log 501. Here, when an anomaly is detected in the log 501, the anomaly detection device 200 notifies an SOC analyst 900 who analyzes the anomaly at an SOC (Security Operation Center) of an alert 701 to notify the anomaly. As a result, the SOC analyst 900 analyzes the cyber attack. The anomaly detection device 200 is an example of an analysis device.

[0061] The log priority calculation device 300 is a computer that determines the log priority, which is the priority of an item to be transmitted by the device group 120 to the log analysis system 400 from among multiple items (types) included in device data. The log priority calculation device 300 periodically acquires necessary information such as analysis rules and analysis results from the anomaly detection device 200, for example, approximately once a day, creates a column list 601 based on the acquired information, and transmits the created column list 601 to the device group 120 at the site 110. The log priority calculation device 300 is an example of an information processing device.

[0062] The column list 601 is information including log priorities that indicate the degree to which items to include in the log 501 are determined from among a plurality of items included in the device data recorded by the device group 120. Details of the column list 601 and the log priorities will be described later.

[0063] When the device group 120 receives the column list 601 from the log priority calculation device 300, it selects items to be sent as the log 501 in accordance with the received column list 601, and sends the log 501 including the selected items (specifically, the log 501 including values ​​corresponding to the items) to the anomaly detection device 200.

[0064] The anomaly detection device 200 and the log priority calculation device 300 are each realized by a communication interface, a non-volatile memory in which a program is stored, a volatile memory that is a temporary storage area for executing the program, an input / output port for sending and receiving signals, a processor that executes the program, etc. The communication interface may be realized, for example, by an antenna and a wireless communication circuit or the like to enable wireless communication, or by a connector to which a communication line is connected to enable wired communication.

[0065] 2 is a diagram showing the overall configuration of a log analysis system 400 according to this embodiment. In FIG. 2, the log analysis system 400 is made up of an anomaly detection device 200 and a log priority calculation device 300.

[0066] The anomaly detection device 200 includes a determination result storage unit 210 , a log storage unit 220 , a rule storage unit 230 , an anomaly determination unit 240 , a communication unit 250 , and an output unit 260 .

[0067] The rule storage unit 230 is a storage device that stores one or more abnormality determination rules that the abnormality determination unit 240 uses to determine whether the log 501 is abnormal.

[0068] The abnormality determination unit 240 is a processing unit that performs abnormality determination on the log 501 received via the communication unit 250 based on one or more abnormality determination rules stored in the rule storage unit 230 .

[0069] Each of the one or more abnormality determination rules is a rule that includes a predetermined condition that uses one or more items from among multiple items included in the device log. That is, the abnormality determination rule is a rule for determining whether one or more items (specifically, values ​​corresponding to the items) satisfy a predetermined condition. For example, the predetermined conditions included in each abnormality determination rule are different from each other, and the one or more items used in each abnormality determination rule differ from each other by one or more. The predetermined condition is, for example, an item included in Condition, which will be described later.

[0070] The determination result storage unit 210 is a storage device that stores the determination result, which indicates whether or not the log 501 has an abnormality, determined by the abnormality determination unit 240 .

[0071] The communication unit 250 is a communication interface for receiving the log 501 from the device group 120 of the site 110 and transmitting (transmitting) the log 501 to the abnormality determination unit 240. Furthermore, if the abnormality determination unit 240 cannot perform abnormality determination using only the received log 501, it transmits an additional log request 502, which is information requesting the device group 120 of the site 110 to transmit an additional log for abnormality determination, to the device group 120 via the communication unit 250, thereby acquiring the log 501 including items necessary for abnormality determination from the device group 120.

[0072] The log storage unit 220 is a storage device that stores a log 501 in which the abnormality determination unit 240 has performed an abnormality determination.

[0073] The output unit 260 is a UI (User Interface) that outputs the determination result of the abnormality determination unit 240 for the log 501, and an alert 701 that is output when it is determined that an abnormality exists in the log 501. The determination result and the alert 701 may be notified to the SOC analyst 900 using a tool such as email, or may be displayed on a display device such as a display provided on a computer or mobile terminal used by the SOC analyst 900. In this case, the output unit 260 may be a processing unit that transmits the determination result and the alert 701 to the computer or mobile terminal used by the SOC analyst 900 via the communication unit 250.

[0074] The processing units such as the abnormality determination unit 240 are realized by, for example, a processor that executes a control program and a memory that stores the control program.

[0075] Furthermore, the storage devices of the determination result storage unit 210, the log storage unit 220, the rule storage unit 230, etc. are realized by, for example, a hard disk drive (HDD) or a solid state drive (SSD), etc. Note that the storage devices of the determination result storage unit 210, the log storage unit 220, the rule storage unit 230, etc. may be realized by a single common storage device, or may be realized by separate storage devices.

[0076] The communication unit 250 may include a wired communication interface or a wireless communication interface. The communication unit 250 may also include a processing unit such as a memory and a processor for transmitting and receiving various types of information.

[0077] Furthermore, when the output unit 260 is realized by a UI, the UI may be a display device such as a display that displays images showing the determination result and the alert 701, or may be a speaker that outputs the determination result and the alert 701 as audio.

[0078] The log priority calculation device 300 includes an abnormality detection information acquisition unit 310 , a log priority determination unit 320 , a log priority storage unit 330 , and an output unit 340 .

[0079] The anomaly detection information acquisition unit 310 is a processing unit that periodically acquires information necessary for determining the priority (also referred to as log priority) of items to be included by the device group 120 in the log 501 transmitted by the device group 120 from the anomaly detection device 200 in a batch process via a communication interface (not shown) or the like provided in the log priority calculation device 300. In this way, the log priority is a degree used to determine which of multiple items to include in the log 501 transmitted to the anomaly detection device 200 that performs anomaly determination. Specifically, the log priority is information indicating which of multiple items included in the device data should be preferentially included in the log 501 transmitted by the device to the anomaly detection device 200. For example, the device includes a predetermined number of items in the log 501 in descending order of priority from the multiple items, and transmits the log 501 to the anomaly detection device 200.

[0080] For example, the log priority has at least two levels: a level indicating that the device group 120 will include each of a plurality of items in the log 501, and a level indicating that the device group 120 will not include it in the log 501. In other words, for example, the log priority is one of at least two levels including a level indicating that the device group 120 will include each of a plurality of items included in the device data in the log 501, and a level indicating that the device group 120 will not include it in the log 501. That is, the log priority, for example, (i) indicates that the device group 120 will include the value of the item in the log 501, or (ii) indicates that the device group 120 will not include the value of the item in the log 501. A log priority indicating that the device group 120 will include the value of an item in the log 501 is, for example, Priority: 0, which will be described later. Furthermore, a log priority indicating that the device group 120 will not include the value of an item in the log 501 is, for example, Priority: 1, which will be described later.

[0081] Furthermore, for example, the log priority determination unit 320 determines the log priority of at least one item among one or more items used in a predetermined condition included in each of one or more anomaly determination rules used by the anomaly detection device 200 so that the log priority is at a level that indicates that the device group 120 should include it in the log 501.

[0082] The anomaly detection information acquisition unit 310 transmits the acquired information to the log priority determination unit 320, for example, via a communication interface (not shown) provided in the log priority calculation device 300. In batch processing, for example, the anomaly detection device 200 transmits to the log priority calculation device 300 information such as anomaly determination rules (specifically, information indicating the anomaly determination rules), determination results (specifically, information indicating the determination results), and logs received from the device group 120. In this way, for example, the anomaly detection information acquisition unit 310 acquires one or more anomaly determination rules, etc. used to determine an anomaly in the device logs. The anomaly detection information acquisition unit 310 is an example of an acquisition unit.

[0083] The anomaly detection information acquisition unit 310 may request the anomaly detection device 200 to transmit information such as the anomaly determination rule, the determination result, and the log received from the device group 120. For example, the anomaly detection information acquisition unit 310 transmits request information to the anomaly detection device 200 requesting that the anomaly detection device 200 transmit this information. For example, when the anomaly detection device 200 receives the request information, it transmits this information to the log priority calculation device 300. In this way, the anomaly detection information acquisition unit 310 may acquire this information.

[0084] The information required to determine the log priority is, for example, at least one of the abnormality determination rules stored in the rule storage unit 230, the abnormality determination results obtained by the abnormality determination unit 240 at predetermined time intervals, and the logs 501 stored in the log storage unit 220 at predetermined time intervals.

[0085] In addition, the anomaly detection information acquisition unit 310 may perform a process (information shaping process) of extracting only the information from the acquired information that is to be used for determining the log priority in the log priority determination unit 320, and then transmit the extracted information to the log priority determination unit 320.

[0086] The log priority determination unit 320 is a processing unit that determines the log priority for each of a plurality of items included in the log recorded by the device group 120, based on the information acquired by the anomaly detection information acquisition unit 310. For example, the log priority determination unit 320 determines the priority of each of the plurality of items based on one or more anomaly determination rules acquired by the anomaly detection information acquisition unit 310. The log priority determination unit 320 creates a column list 601 that includes information indicating the determined log priorities. The log priority determination unit 320 is an example of a determination unit.

[0087] For example, the log priority determination unit 320 determines the log priority for each predetermined period (first period).

[0088] Furthermore, for example, the log priority determination unit 320 determines the priority based on the determination result of the abnormality determination of the log 501 executed by the anomaly detection device 200 using one or more anomaly determination rules (the abnormality determination result described below). For example, the anomaly detection information acquisition unit 310 acquires the determination result of the abnormality determination of the log 501 executed using one or more anomaly determination rules. The determination result includes, for example, a result of determining whether each of one or more items included in the log 501 satisfies a predetermined condition included in each of the one or more anomaly determination rules. For example, the log priority determination unit 320 determines the priority of each of multiple items included in the device data (specifically, the priority of each of one or more items included in the log 501) based on the determination result acquired by the anomaly detection information acquisition unit 310. Note that for items included in the device data but not used in the determination using the anomaly determination rule, a priority may not be determined, or a priority may be set indicating that the device group 120 does not include the item in the log 501.

[0089] The log priority storage unit 330 is a storage device that stores the log priorities determined by the log priority determination unit 320. Specifically, the log priority storage unit 330 stores a column list 601 created by the log priority determination unit 320.

[0090] The output unit 340 is a processing unit that outputs the log priority to the device group 120. Specifically, the output unit 340 transmits a column list 601 including information indicating the log priority to the device group 120 via a communication interface (not shown) provided in the log priority calculation device 300. For example, if the column list 601 created by the log priority determination unit 320 has changed from the most recent column list 601 among the past column lists 601 stored in the log priority storage unit 330, the output unit 340 transmits the column list 601 created by the log priority determination unit 320 to the device group 120 at the site 110 via a communication interface (not shown) provided in the log priority calculation device 300. In other words, if any of the log priorities of each of the multiple items determined by the log priority determination unit 320 has changed from the previously determined log priorities of each of the multiple items stored in the log priority storage unit 330, the output unit 340 outputs the log priority currently determined by the log priority determination unit 320. In this way, for example, the log priority calculation device 300 stores the determined priorities, determines the priorities for each predetermined first period, and outputs the determined priorities when there is a change in any of the determined priorities of the multiple items from the stored priorities of the multiple items. The output unit 340 is an example of an output unit.

[0091] For example, the output unit 340 outputs only the log priorities of items that have changed. Specifically, the output unit 340 outputs only the priorities of items that have changed from the priorities of items stored in the log priority storage unit 330, among the priorities of the items determined by the log priority determination unit 320. Of course, if there is a change in the log priorities, the output unit 340 may output all of the log priorities that have been determined this time.

[0092] The communication interface (not shown) included in the log priority calculation device 300 only needs to be able to communicate with the anomaly detection device 200, and may be a wired communication interface or a wireless communication interface.

[0093] [Processing Procedure] FIG. 3 is a flowchart showing an example of an abnormality determination process executed by the abnormality detection device 200 according to this embodiment.

[0094] (S711) The communication unit 250 of the anomaly detection device 200 receives the log 501 from the device group 120. The received log 501 is stored in the log storage unit 220.

[0095] Here, the details of the log 501 sent from the device group 120 will be described.

[0096] Fig. 4 is a diagram showing an example of device data in this embodiment. Specifically, Fig. 4 is a diagram showing an example of a communication log of the device group 120, which is one of the device data recorded by the device group 120 in this embodiment.

[0097] In Fig. 4, the device data includes multiple items that make up a communication log, i.e., multiple columns. Each of the three communication logs shown as an example in Fig. 4 includes nine columns: uid, ts, ip_src, port_src, ip_dst, port_dst, protocol, nw_bytes, and nw_status. In the following description, the columns refer to the items that make up the communication log.

[0098] The uid is a column (item) that indicates an identifier for uniquely identifying a communication log.

[0099] ts is a column indicating the date and time when the communication was observed.

[0100] ip_src is a column indicating the source IP address of the source device.

[0101] The port_src column indicates the source port number of the source device.

[0102] ip_dst is a column indicating the destination IP address of the destination device.

[0103] The port_dst is a column indicating the destination port number of the destination device.

[0104] The protocol column indicates the type of communication protocol used by the source device to communicate with the destination device.

[0105] nw_bytes is a column indicating the amount of communication performed by the source device to the destination device.

[0106] nw_status is a column that indicates the status of whether or not the communication between the source device and the destination device was successful.

[0107] For example, in FIG. 4, of the three communication logs, the communication log identified by uid01 indicates that at time "2022 / 12 / 01 16:54:34", communication of 738,000 bytes was performed using the HTTP protocol from source IP address 192.168.1.1 and source port number 4767 to destination IP address 192.168.1.2 and destination port number 8080, and nw_status is "True", meaning that the communication was successful.

[0108] 4 is an example, and other columns may be included. Furthermore, the device data is not limited to communication logs in the device group 120, and may also include logs related to device operations (operation logs). The operation log is a log including multiple columns indicating information related to device operations, such as event tasks, date and time, or sources, exchanged on the operating system of a computer included in the device.

[0109] For example, one or more columns are selected from such a plurality of columns, and the values ​​of the selected one or more columns are included in the log 501 , and the log 501 is sent to the anomaly detection device 200 .

[0110] Returning to the description of the abnormality determination process in FIG.

[0111] (S712) The abnormality determination unit 240 acquires the abnormality determination rule stored in the rule storage unit 230.

[0112] Here, the abnormality determination rules will be described in detail.

[0113] FIG. 5 is a diagram showing an example of an abnormality determination rule used by the abnormality determination unit 240 in this embodiment to determine an abnormality in the log 501.

[0114] 5 shows three abnormality determination rules: model-01, model-02, and model-03. Each abnormality determination rule includes an ID, a Name, a Condition, Params, a Period, a Threshold, and a Type.

[0115] The ID indicates the identifier of the abnormality determination rule.

[0116] Name indicates the name of the abnormality determination rule.

[0117] The Condition indicates a condition (also referred to as a first condition) for determining an abnormality for a column included in the log 501. The condition for determining an abnormality includes, for example, the type of at least one target column, which is a column included in the log 501 for which an abnormality determination is to be performed, and a condition for the at least one target column.

[0118] Params indicates an aggregation parameter used by the anomaly detection device 200 to determine an anomaly. Specifically, Param is a column used to aggregate (classify) multiple logs 501 when determining an anomaly. For example, the anomaly detection device 200 classifies multiple logs 501 into logs 501 with the same value in a column indicated by the aggregation parameter, thereby creating a set of logs 501 with the same value in the column.

[0119] Period indicates the aggregation period of the aggregation parameters.

[0120] The threshold indicates a condition (also referred to as a second condition) under which the anomaly detection device 200 determines an anomaly. Specifically, the threshold indicates a threshold value for the number (total number) of logs 501 that the anomaly detection device 200 determines to be an anomaly. For example, the anomaly detection device 200 determines whether the total number of logs 501 that match the condition indicated by Condition (first condition) among one or more logs 501 included in a predetermined group to which multiple logs 501 aggregated (received) during an aggregation period belong is equal to or greater than the threshold indicated by Threshold, that is, whether the second condition is satisfied. If the anomaly detection device 200 determines that the total number is equal to or greater than the threshold, it determines that an anomaly exists in the log 501. In other words, in this case, the anomaly detection device 200 determines that the device that transmitted the log 501 used to determine the anomaly has some kind of malfunction, such as being subjected to a cyber attack. On the other hand, if the anomaly detection device 200 determines that the total number is less than the threshold, it determines that no anomaly exists. In other words, in this case, the anomaly detection device 200 determines that the device that sent the log 501 used for the anomaly determination is normal. The first condition and the second condition are examples of predetermined conditions. In this way, the predetermined condition is a condition that uses one or more items.

[0121] The Type indicates the type of log for which the abnormality determination rule is to be executed.

[0122] Note that the Type of each anomaly determination rule shown in FIG. 5 is a log type indicated by "device_com_log," but is not limited to this. The Type may include multiple log types, such as a DNS query information log or an HTTP request log. For example, among multiple logs 501 transmitted from the device group 120, logs 501 of different log types may include different types of columns. In this embodiment, the log 501 indicated by the log type "device_com_log" is a log of communication performed between the device group 120, and is data such as that shown in FIG. 4.

[0123] For example, in FIG. 5 , the abnormality determination rule whose ID is model-01 is an abnormality determination rule for determining the abnormality of "multiple HTTP access failures detected" for the log 501 whose log type is "device_com_log." Furthermore, in this abnormality determination rule, the aggregation parameter is ip_src (source IP address), the aggregation period is 10 minutes, and the threshold is 100. That is, when the logs 501 are aggregated for each of the multiple ip_src values ​​contained in the multiple logs 501, an abnormality is determined if, among the aggregated logs 501 showing the same ip_src value, the number of logs 501 that match "protocol=http, ip_dst=192.168.1.0 / 24, nw_status=rejected" within a 10-minute period is 100 or more. The abnormality determination is performed for each set of logs 501 having the same ip_src value.

[0124] Returning to the description of the abnormality determination process in FIG.

[0125] (S713) The abnormality determination unit 240 performs an abnormality determination, including determining whether one or more logs 501 for a predetermined period (first period) stored in the log storage unit 220 match a first condition indicated in Condition included in the abnormality determination rule acquired in step S712 (also referred to as a first determination), and determining whether the number of logs 501 that match the first condition exceeds a threshold indicated in Threshold included in the abnormality determination rule (also referred to as a second determination). Specifically, the abnormality determination unit 240 determines whether the columns included in the logs 501 satisfy the condition indicated in Condition of the abnormality determination rule when the logs 501, of which the log type matches the type indicated in Type of the abnormality determination rule, are aggregated (classified) by the aggregation parameters indicated in Params of the abnormality determination rule, among the one or more logs 501 for a predetermined period stored in the log storage unit 220. Furthermore, the abnormality determination unit 240 determines whether the number of logs 501 that satisfy the condition exceeds the threshold indicated in the Threshold of the abnormality determination rule within the aggregation period.

[0126] If the abnormality determination rule does not include an aggregation parameter, the abnormality determination unit 240 performs abnormality determination on all of the one or more logs 501 acquired for a predetermined period. If the abnormality determination rule does not include an aggregation period, the abnormality determination unit 240 determines only whether the number of logs 501 that satisfy the conditions exceeds a threshold, regardless of the aggregation period.

[0127] The predetermined period may be set arbitrarily and is not particularly limited. For example, the predetermined period and the aggregation period may be the same period or different periods.

[0128] For example, when the abnormality determination unit 240 determines whether multiple logs 501 with the log type "device_com_log" are abnormal based on the abnormality determination rule whose ID is indicated by model-02, the abnormality determination unit 240 first aggregates the logs 501 for each value of the aggregation parameter "ip_src." Then, for the aggregated logs 501, the abnormality determination unit 240 determines whether there is one or more logs 501 that satisfy the condition "nw_bytes > 1 GB" indicated in the Condition field within the 10-minute aggregation period indicated by the threshold value. For example, if the nw_bytes column of a certain log 501 is "nw_bytes = 1.2 GB," the abnormality determination unit 240 determines that the condition indicated in the Condition field is met, that is, that the first condition is satisfied.

[0129] Furthermore, when the condition indicated in Condition indicates multiple types of columns as columns to be determined, the anomaly determination unit 240 determines whether the condition is met for all of the columns to be determined. For example, consider a case where the protocol, ip_dst, and nw_status columns included in the log 501 are "protocol=http, ip_dst=192.168.1.0 / 24, nw_status=true," and the anomaly determination unit 240 performs an anomaly determination using an anomaly determination rule whose ID is model-01. In this case, when compared with the condition indicated in Condition included in the anomaly determination rule, the protocol and ip_dst columns match the condition indicated by the anomaly determination rule, but the nw_status column does not match the condition. Therefore, since all the conditions are not satisfied, the abnormality determination unit 240 determines that the log 501 does not match the conditions indicated in the Condition, that is, does not satisfy the first condition.

[0130] If there are multiple anomaly determination rules, the anomaly determination unit 240 performs the same anomaly determination as described above for all of the anomaly determination rules. In this case, if the number of logs 501 determined to satisfy the conditions specified by any of the anomaly determination rules exceeds a threshold value within the aggregation period, the anomaly determination unit 240 determines that the anomaly determination rule is met, that is, that an anomaly exists. Furthermore, the anomaly determinations based on the respective anomaly determination rules may be performed in parallel or sequentially in any order.

[0131] Furthermore, if some of the multiple determination target columns specified in the anomaly determination rule are not included in the log 501, the anomaly determination unit 240 performs determination on the remaining determination target columns excluding those some of the determination target columns. In this case, the anomaly determination unit 240 determines that the anomaly determination rule is met if all of the other determination target columns excluding those some of the determination target columns meet the conditions specified in the anomaly determination rule.

[0132] For example, consider the case where an abnormality is determined for a log 501 that includes three columns: protocol, ip_src, nw_status, and nw_bytes. In the abnormality determination rule whose ID is model-02, the nw_bytes column is included in the columns to be determined. In contrast, the abnormality determination rule whose ID is model-01 and the abnormality determination rule whose ID is model-03 each include the ip_dst column in the columns to be determined. However, ip_dst is not included in the log 501 in the above case. Therefore, when the abnormality determination unit 240 performs an abnormality determination for such a log 501 using the abnormality determination rule whose ID is model-01 and the abnormality determination rule whose ID is model-03, the abnormality determination unit 240 performs the determination for the columns to be determined, namely, protocol, ip_src, and nw_status, excluding ip_dst.

[0133] (S714) The abnormality determination unit 240 checks whether, as a result of performing the abnormality determination on the logs 501 in step S713, it has determined that one or more of the logs 501 that were the subject of the determination match the abnormality determination rule. That is, the abnormality determination unit 240 determines, as a result of performing the second determination, whether one or more of the logs 501 that were the subject of the determination satisfy the second condition. If the abnormality determination unit 240 determines that one or more of the logs 501 match the abnormality determination rule (YES in step S714), the process proceeds to step S715. On the other hand, if the abnormality determination unit 240 determines that none of the one or more logs 501 match the abnormality determination rule (NO in step S714), the process proceeds to step S718.

[0134] (S715) When the abnormality determination unit 240 performed an anomaly determination on the log 501 using the anomaly determination rule in step S713, it determines whether all of the determination target columns specified in the anomaly determination rule were included in the log 501. That is, the abnormality determination unit 240 determines whether the log 501 does not include all of the determination target columns specified in the anomaly determination rule and whether there are any missing columns (also simply referred to as missing columns). For example, if the anomaly determination unit 240 determines that ip_dst, one of the determination target columns in the anomaly determination rule, is not included in the log 501 and performs a determination on the other determination target columns excluding ip_dst, it determines that there are missing columns. If the abnormality determination unit 240 determines that there are missing columns (YES in step S715), it proceeds to step S716. If the abnormality determination unit 240 determines that there are no missing columns (NO in step S715), it proceeds to step S717.

[0135] (S716) The anomaly determination unit 240 performs a missing column acquisition process, which is a process for acquiring missing columns. If a missing column exists, anomaly determination cannot be performed for all of the target columns specified in the anomaly determination rule. For example, if ip_dst is a missing column, in order for the anomaly determination unit 240 to perform anomaly determination for all target columns specified in the anomaly determination rule for model-03, the anomaly determination unit 240 must acquire the missing column, ip_dst, and then perform anomaly determination again. Therefore, the anomaly determination unit 240 performs a missing column acquisition process to acquire the missing column. The missing column acquisition process will be described later. The anomaly determination unit 240 acquires the log 501 containing the missing column through the missing column acquisition process, and returns to step S713 to perform anomaly determination again, including the missing column included in the acquired log 501.

[0136] (S717) The output unit 260 outputs information indicating the result of the abnormality determination for the log 501 that matched the abnormality determination rule in the abnormality determination in step S713 (also simply referred to as the abnormality determination result) as an alert 701. The alert 701 may be displayed on a display device such as a display provided in the log analysis system 400 (for example, a display device provided in the output unit 260 if the output unit 260 is a UI), or may be displayed on a display device provided in a computer or mobile terminal used by the SOC analyst 900, or may be notified to the SOC analyst 900 using a tool such as email.

[0137] (S718) The log storage unit 220 stores the log 501 received in step S711. The information in the stored log 501 (also simply referred to as log information) is used, for example, when the abnormality determination unit 240 performs an abnormality determination using an abnormality determination rule other than the abnormality determination rule used in the abnormality determination in step S713, when the log priority calculation device 300 determines a log priority, or when the SOC analyst 900 performs analysis.

[0138] (S719) The determination result storage unit 210 stores the abnormality determination result, and the abnormality determination process ends.

[0139] Here, a specific example of the abnormality determination result will be described.

[0140] FIG. 6 is a diagram showing an example of an abnormality determination result in this embodiment.

[0141] The abnormality determination result is the result of abnormality determination for each of the one or more received logs 501. In Fig. 6, the abnormality determination result includes Ts, ID, Elements, and Result.

[0142] Ts indicates the date and time when an abnormality determination based on the abnormality determination rule was performed on the log 501 .

[0143] The ID indicates the ID of the abnormality determination rule used for the abnormality determination.

[0144] Elements indicates the judgment result (specifically, the judgment result of the first judgment) of each column under the judgment condition (specifically, the first condition) indicated by the anomaly judgment rule. For example, true indicates that the value of the corresponding column satisfies the first condition. On the other hand, false indicates that the value of the corresponding column does not satisfy the first condition.

[0145] Result indicates the determination result of whether the log 501 matches the abnormality determination rule (that is, the determination result of the second determination), that is, the determination result of the entire abnormality determination rule.

[0146] Note that the abnormality determination results shown in FIG. 6 are all abnormality determination results for logs 501 whose log type is "device_com_log", but abnormality determination results for logs 501 of other log types may also be included.

[0147] 6, for example, the abnormality determination result for a log with Ts of "2022 / 12 / 01 17:32:18" and an ID of "model-01" shows that the Elements indicating the determination result of the first determination are protocol: true, ip_dst: false, and nw_status: false, and the Result indicating the determination result of the second determination is false. In other words, the log 501 that was the subject of this abnormality determination matched the first condition indicated in the abnormality determination rule with an ID of "model-01" in terms of protocol, but did not match in terms of ip_dst and nw_status, and therefore was determined to not match the abnormality determination rule.

[0148] 6, the abnormality determination result where Ts is "2022 / 12 / 01 18:42:54" and the ID is "model-01" is "true." This indicates that the number of logs 501 that were determined to match the abnormality determination rule for model-01, that is, that matched all of the determination conditions specified in the abnormality determination rule for model-01, exceeded the threshold value within the aggregation period. In other words, this indicates that the number of logs 501 that meet the first condition specified in the abnormality determination rule for model-01 meets the second condition.

[0149] Although not shown, if the number of logs 501 that match all the judgment conditions specified in any abnormality judgment rule does not exceed the threshold value within the aggregation period, the result will be false even if all the judgment results for each column in the abnormality judgment result are true.

[0150] Furthermore, in the present embodiment, when multiple anomaly determination rules exist, anomaly determination is performed for all of the anomaly determination rules in parallel or sequentially in step S713, but this is not limited thereto. For example, the anomaly detection device 200 may perform anomaly determination for only some of the anomaly determination rules in step S713 and repeat the anomaly determination process multiple times until anomaly determination is performed for all of the anomaly determination rules. When the anomaly determination process is repeatedly performed, in step S711, the anomaly determination unit 240 acquires, from the log storage unit 220, logs 501 for which anomaly determination has not been completed for all of the anomaly determination rules, and performs an anomaly determination for the acquired logs 501 in step S713. This reduces the resources of the anomaly detection device 200 required to perform one anomaly determination process. Furthermore, for example, even if an anomaly determination rule other than the anomaly determination rule used in the anomaly determination in step S713 is added, an anomaly determination for the added anomaly determination rule can be performed.

[0151] Furthermore, in the present embodiment, the abnormality determination unit 240 performs an abnormality determination for one or more logs 501 for a predetermined period stored in the log storage unit 220, but this is not limited to this. For example, the abnormality determination unit 240 may directly acquire the logs 501 received by the communication unit 250 and perform an abnormality determination for each log 501 one by one. This allows the abnormality detection device 200 to perform an abnormality determination for the received logs 501 in real time.

[0152] Next, the missing column acquisition process will be described.

[0153] 7 is a flowchart showing an example of a missing column acquisition process in the abnormality determination process executed by the abnormality detection device 200 according to this embodiment. Specifically, FIG. 7 is a flowchart showing the details of the process of step S716.

[0154] (S721) The abnormality determination unit 240 determines whether or not information about a missing column that should be additionally determined to be abnormal exists in the log storage unit 220 included in the abnormality detection device 200. If the information about the missing column exists in the log storage unit 220 (YES in step S721), the abnormality detection device 200 executes step S724, and if the information about the missing column does not exist in the log storage unit 220 (NO in step S721), the abnormality detection device 200 executes step S722.

[0155] Here, information about the missing column exists in the log storage unit 220 when, for example, a log 501 including the missing column was stored in the log storage unit 220 when the missing column acquisition process was previously executed. For example, in step S713, while the anomaly detection device 200 is executing anomaly determinations for multiple anomaly determination rules in parallel or sequentially, the same specific column may be a missing column multiple times. In the example shown in FIG. 5 , if the ip_dst column is a missing column in the anomaly determination for the anomaly determination rule indicated by ID model-01, the column may also be a missing column in the anomaly determination for the anomaly determination rule indicated by ID model-03. In such a case, assume that the missing column acquisition process is executed once, and the log 501 including the missing column (here, the ip_dst column) is acquired from the device group 120 and stored in the log storage unit 220. In such a case, in subsequent missing column acquisition processes, the anomaly detection device 200 can acquire information about the missing column from the log storage unit 220 without sending an additional log request 502 to the device group 120.

[0156] (S722) The communication unit 250 requests the device group 120 at the site 110 to add columns (i.e., missing columns) in order to acquire the missing columns. Specifically, the communication unit 250 sends an additional log request 502 to the device group 120. The additional log request 502 is information including a uid, which is a log identifier for the log 501 in which a missing column exists, and the column name of the missing column. Upon receiving the additional log request 502, the device group 120 sends the log 501, which includes information on the missing columns indicated by the column names included in the additional log request 502, to the anomaly detection device 200.

[0157] (S723) The communication unit 250 receives the log 501 including the additional column (i.e., the missing column) sent from the device group 120 in response to the additional log request 502, and transmits the received log 501 to the abnormality determination unit 240. The communication unit 250 also stores the log 501 including the missing column in the log storage unit 220, and ends the missing column acquisition process.

[0158] (S724) The abnormality determination unit 240 searches for and acquires the log 501 having the same uid as the log 501 containing the missing column, i.e., the log 501 containing the missing column, from among the multiple logs 501 stored in the log storage unit 220.

[0159] (S725) The abnormality determination unit 240 determines whether the log 501 acquired in step S724 contains information on all missing columns. If the abnormality determination unit 240 determines that information on all missing columns is not included and that missing columns still remain (YES in step S725), the process proceeds to step S722. On the other hand, if the abnormality determination unit 240 determines that information on all missing columns is included in the log 501 acquired in step S724 and that missing columns do not remain (NO in step S725), the process ends the missing column acquisition process.

[0160] Next, a description will be given of a log priority update process executed by the log priority calculation device 300. The log priority update process is a process that is executed periodically, for example, about once a day. The execution frequency of the log priority update process can be set by the SOC analyst 900 or the like as appropriate depending on the environment of the monitored site 110 or the environment of the log analysis system 400.

[0161] FIG. 8 is a flowchart showing an example of the log priority update process according to this embodiment.

[0162] (S731) The log priority calculation device 300 performs a log priority calculation process to create a column list 601. The log priority calculation device 300 determines log priorities by performing a log priority calculation process (described later) based on, for example, an abnormality determination rule for each log type acquired from the anomaly detection device 200 and the abnormality determination result or log information for each log type, and creates a column list 601 indicating the determined log priorities. For example, the column list 601 for a log 501 of a log type indicated by "device_com_log" is created based on an abnormality determination rule whose Type is "device_com_log" and the abnormality determination result or log information for the log 501 of that log type.

[0163] Here, the log priority and the column list 601 will be described in detail. The log priority indicates, for example, the degree to which columns to be included in the log 501 are determined from among the columns included in a communication log indicating the results of communication between devices that can be included in the log 501 of any log type. The column list 601 is created, for example, for each log type. The device group 120 at the site 110 selects columns to be included in and transmitted in the log 501 of each log type in accordance with the log priority included in the column list 601, and then transmits the log 501 of each log type, including the selected columns, to the anomaly detection device 200.

[0164] FIG. 9 is a diagram showing an example of the column list 601 stored in the log priority storage unit 330 in this embodiment.

[0165] 9, the column list 601 includes a Type indicating the log type, a Priority indicating the log priority for each column, and Columns indicating each column. The smaller the log priority value indicated by Priority for each column, the higher the priority the device group 120 will include in the log 501 the column associated with that log priority. At least some Priority value is assigned to each column.

[0166] For example, in FIG. 9, in the case of a log 501 of a log type indicated by Type as "device_com_log", the columns ip_dst and nw_bytes, which have the smallest Priority of 0, are the columns that are given the highest priority to be included in the log 501 of that log type, i.e., the first priority logs.

[0167] Furthermore, the columns nw_status, ip_src, and protocol, each of which has a Priority of 1, the next highest value after 0, indicate that the column is included in the log 501 of the corresponding log type with the next highest priority after the first priority log, i.e., the second priority log.

[0168] Furthermore, the columns ts, port_src, and port_dst, each having a priority of 2, which is the next highest after 1, indicate that they are columns that are included in the log 501 of the corresponding log type with the next highest priority after the second priority log, i.e., third priority logs.

[0169] Note that Priority, which indicates the log priority, is not limited to this, and may be represented by at least two-stage values ​​indicating columns that must be included in the log 501 and columns that do not necessarily have to be included in the log 501. In this embodiment, the first-priority log is at least a column that is included in the log 501. Also, the larger the Priority value, the higher the priority of inclusion in the log 501. Also, the upper limit of the number of columns that can be included in the log 501 may be arbitrarily determined in advance, and the amount of data that can be included in the log 501 may be arbitrarily determined in advance.

[0170] Returning to the description of the log priority update process in FIG.

[0171] (S732) The log priority determination unit 320 acquires the most recent column list 601 from the past column lists 601 stored in the log priority storage unit 330. The most recent column list 601 is the column list 601 stored as a result of the previous log priority update process.

[0172] (S733) The log priority determination unit 320 compares the column list 601 created in step S731 with the column list 601 acquired in step S732 and determines whether there has been a change in the log priority for each column included in the column list 601. For example, if the Priority indicating the log priority of nw_status included in the log 501 whose log type is "device_com_log" is 0 in the most recent column list 601 and 1 in the column list 601 created in step S731, the log priority calculation device 300 determines that there has been a change in the log priority. If there has been a change in the log priority (YES in step S733), the log priority calculation device 300 proceeds to processing of step S734. If there has been no change in the log priority (NO in step S733), the log priority calculation device 300 proceeds to processing of step S735.

[0173] (S734) The output unit 340 acquires the column list 601 created in step S731 from the log priority determination unit 320, and outputs the acquired column list 601 to the device group 120 of the site 110 for transmission.

[0174] The output unit 340 may output the column list 601 created in step S731 to the device group 120 as is, or may output only the difference between the column list 601 created in step S731 and the column list 601 acquired in step S732 to the device group 120.

[0175] (S735) The log priority storage unit 330 stores the column list 601 created in step S731, and ends the log priority update process.

[0176] In the present embodiment, the log priority calculation device 300 first creates a column list 601 in the log priority update process, and if there is a change in the log priority for each column, outputs the created column list 601 to the device group 120 at the site 110. However, this is not limited to this. For example, in step S731, the log priority calculation device 300 may create the column list 601 by performing a log priority calculation process if there is a change in any of the anomaly determination rules for each log type acquired from the anomaly detection device 200 from a previously acquired anomaly determination rule. This allows the log priority calculation device 300 to perform the log priority calculation process only if there is a change in any of the anomaly determination rules, thereby reducing the resources required by the log priority calculation device 300.

[0177] Next, the log priority calculation process will be described.

[0178] 10 is a flowchart showing an example of the log priority calculation process according to the present embodiment. Specifically, FIG. 10 is a flowchart showing an example of the details of the process of step S731. In the example shown in FIG. 10, the log priority calculation device 300 determines the log priority for each log type using the result of the abnormality determination performed by the abnormality determination unit 240 in step S713, i.e., using the abnormality determination result, and creates and outputs a column list 601 for each log type.

[0179] (S741) The abnormality detection information acquisition unit 310 acquires, for example, the abnormality determination results shown in FIG. 6 from the abnormality detection device 200 (specifically, the determination result storage unit 210) as abnormality determination results for a predetermined past period for the log 501 of an arbitrary log type, and transmits the acquired abnormality determination results to the log priority determination unit 320. Note that, as described above, all of the abnormality determination results shown in FIG. 6 are abnormality determination results for the log 501 whose log type is "device_com_log."

[0180] (S742) The log priority determination unit 320 calculates a column match rate for each column for each anomaly determination rule indicated by the ID of the anomaly determination result, based on the determination results for each column indicated by Elements in the anomaly determination result acquired in step S741. The column match rate indicates the ratio of the number of times a column matches the condition indicated by the anomaly determination rule (the number of true results) to the number of determination results acquired for any one anomaly determination rule (the target anomaly determination rule). Specifically, the column match rate for each column is calculated for each anomaly determination rule using the following formula (1). Note that in this embodiment, the column match rate corresponds to the match rate.

[0181]

[0182] Fig. 11 is a diagram showing an example of a log priority determination process using an anomaly determination result in this embodiment. Specifically, Fig. 11 shows a process of determining a log priority for each column and a process of creating a column list 601 when a column match rate is calculated based on the anomaly determination result shown in Fig. 6. Note that Fig. 11(a) is a diagram showing an example of the column match rate, Fig. 11(b) is a diagram showing an example of the log priority calculated from the column match rate, and Fig. 11(c) is a diagram showing a column list 601 showing the log priority re-determined based on the log priority calculated from the column match rate and the anomaly determination rule.

[0183] The calculation result of the column match rate shown in FIG. 11 includes, for example, Rule, Count, Match count, and Rate.

[0184] Rule indicates the ID of the abnormality determination rule.

[0185] Count indicates the number of determination results obtained according to each abnormality determination rule included in the abnormality determination result.

[0186] The Match count indicates the number of cases in which the conditions are met in the determination results according to each anomaly determination rule for each column, that is, the number of cases in which the determination result is true.

[0187] Rate indicates the column match rate for each column.

[0188] 6 includes four determination results based on the abnormality determination rule with ID model-01, as shown in (a) of Figure 11. Among these four determination results, the number of determination results that match the condition (Condition), i.e., the number of true determination results, is three for protocol, one for ip_dst, and three for nw_status, for each column. Therefore, when the column match rate for each column is calculated using the above formula (1), the result is 75% for protocol since 3 / 4 = 0.75, 25% for ip_dst since 1 / 4 = 0.25, and 75% for nw_status since 3 / 4 = 0.75.

[0189] Similarly, in Rule: model-02, Count: 1 and Match count for nw_bytes: 1, so the column match rate of nw_bytes is 1 / 1=1, that is, 100%.

[0190] In addition, in Rule:model-03, Count: 1, and Match counts are protocol: 1, ip_src: 1, and ip_dst: 0, so the column match rates for each column are protocol: 100%, ip_src: 100%, and ip_dst: 0%.

[0191] (S743) Based on the column match rates of each column of all the anomaly determination rules calculated in step S742, the log priority determination unit 320 determines whether there is a column that satisfies the conditions (priority log threshold) predefined as a policy.

[0192] For example, if the condition for the column match rate is set to 50% or less, in other words, if a policy is set in advance to transmit columns with a column match rate of 50% or less, as shown in FIG. 11A, the column match rate for ip_dst is 25% for model-01 and 0% for model-03, thereby satisfying the 50% or less condition. Therefore, in this case, the log priority determination unit 320 determines that a column that satisfies the condition exists. If the log priority calculation device 300 determines that a column that satisfies the condition exists (YES in step S743), it proceeds to step S744. If a column that satisfies the condition does not exist (NO in step S743), it proceeds to step S745.

[0193] The condition for the column match rate is not limited to one, and multiple conditions may be defined. When multiple conditions are defined, for example, the log priority calculation device 300 determines that a column that satisfies the condition exists if any of the conditions is satisfied. Furthermore, the condition may be a predetermined number (e.g., two) of columns with a low column match rate.

[0194] (S744) The log priority determination unit 320 determines the log priority for each column based on the conditions and creates a column list 601. In this embodiment, the log priority determination unit 320 determines the log priority by assigning a first-priority log with Priority: 0 to a column that satisfies the condition, i.e., a column whose column match rate satisfies the priority log threshold (first-priority threshold), in other words, a column whose column match rate is equal to or less than the priority log threshold, and assigning a second-priority log with Priority: 1 to a column that does not satisfy the condition, and creates the column list 601. In the example shown in FIG. 11B, the first-priority log (Priority: 0) is ip_dst, and the second-priority log (Priority: 1) is nw_bytes, nw_status, ip_src, and protocol. Note that if there are multiple conditions, two or more priorities may be defined, and multiple priority logs may exist, starting from the third-priority log.

[0195] (S745) The log priority determination unit 320 acquires anomaly determination rules. Specifically, the log priority determination unit 320 acquires, from the anomaly detection device 200 (specifically, the rule storage unit 230) via the anomaly detection information acquisition unit 310, anomaly determination rules (specifically, information indicating the anomaly determination rules) for which the log type indicated in Type is the same as the log type for which the column list 601 is to be created, from among the one or more anomaly determination rules used in the anomaly determination in step S713. In this embodiment, the log priority determination unit 320 acquires three anomaly determination rules, model-01, model-02, and model-03, for which the log type is "device_com_log" and is indicated in Type.

[0196] (S746) The log priority determination unit 320 adds the column indicated as an aggregate parameter in the anomaly determination rule acquired in step S745 to the column list 601 created in step S744 as a first-priority log, i.e., with a Priority indicating log priority of 0. Note that if the column added to the first-priority log is included in the column list 601 as a log other than the first-priority log, the entry for that column other than the first-priority log may be deleted. In this embodiment, the anomaly determination rules acquired in step S745 are the anomaly determination rules for model-01, model-02, and model-03. Of these anomaly determination rules, the anomaly determination rules for model-01 and model-02 indicate that the "ip_src" column is an aggregate parameter. Therefore, the log priority determination unit 320 adds the "ip_src" column to the column list 601 as a first-priority log. In this embodiment, if an aggregation parameter is defined in an anomaly determination rule, the aggregation parameter corresponds to an item required for anomaly determination. For example, the log priority determination unit 320 determines the log priority for an item required for anomaly determination, which is included in each of one or more anomaly determination rules used by the anomaly detection device 200, so that the log priority is indicative of the degree to which the device group 120 indicates that the item should be included in the log 501. As described above, the anomaly detection device 200 classifies (aggregates) the multiple logs 501 into multiple groups using aggregation parameters (predetermined items) and performs anomaly determination for each group. Therefore, for example, the log priority determination unit 320 determines the priority so that the log priority of the aggregation parameter is indicative of the degree to which the device group 120 indicates that the item should be included in the log 501.

[0197] (S747) The log priority determination unit 320 compares the target columns (e.g., aggregation parameters) defined in the anomaly determination rules acquired in step S745 with the column list 601 created in step S744 to determine whether at least one of the target columns for each anomaly determination rule is included in the first-priority log in the created column list 601. If the log priority determination unit 320 determines that at least one of the target columns for each anomaly determination rule is included in the first-priority log in the created column list 601 (YES in step S747), it terminates the log priority calculation process. If the log priority determination unit 320 determines that at least one of the target columns for each anomaly determination rule is not included (NO in step S747), it proceeds to step S748.

[0198] 11 , the columns to be judged for the abnormality determination rule for model-01 are Protocol, ip_dst, and nw_status. Here, ip_dst is included in the first-priority log in the column list 601, so the log priority determination unit 320 determines that at least one of the columns to be judged for the abnormality determination rule is included in the first-priority log in the created column list 601. In contrast, the column to be judged for the abnormality determination rule for model-02 is nw_bytes. Here, nw_bytes is not included in the first-priority log in the column list 601, so the log priority determination unit 320 determines that the column to be judged for the abnormality determination rule is not included in the first-priority log in the created column list 601.

[0199] (S748) The log priority determination unit 320 acquires the column with the lowest column match rate from among the columns to be determined as being included in the first-priority log in the created column list 601 by the anomaly determination rule determined in step S747. For example, if there are multiple columns with the lowest column match rates, the log priority determination unit 320 acquires one of those columns. For example, in the example shown in FIG. 11 , it is determined in step S747 that none of the columns to be determined as being included in the first-priority log are included in the anomaly determination rule for model-02. Therefore, the log priority determination unit 320 selects and acquires the column with the lowest column match rate (nw_bytes) from among the columns to be determined as being included in the anomaly determination rule for model-02.

[0200] (S749) The log priority determination unit 320 adds the column acquired in step S748 to the column list 601 created in step S744 as the first-priority log, i.e., with Priority indicating the log priority set to 0. Then, the log priority calculation process ends.

[0201] Note that if a column added to the first-priority log is included in the column list 601 as a column other than the first-priority log, the log priority determination unit 320 may delete the entry for that column other than the first-priority log. For example, in the example shown in FIG. 11 , the nw_bytes column is added as the first-priority log, and the nw_bytes column shown as the second-priority log is deleted. Therefore, as shown in (c) of FIG. 11 , in the finally created column list 601, the first-priority log (Priority: 0) becomes ip_dst, nw_bytes, and ip_scr, and the second-priority log (Priority: 1) becomes nw_status and protocol.

[0202] Effect of the Embodiment The log priority calculation device 300 according to the present embodiment periodically determines log priorities, creates a column list 601, and outputs the column list 601 to the device group 120 at the site 110. This enables the device group 120 to include in the log 501 only columns with high priority in the column list 601, among columns of information (device data) including internal device logs (e.g., operation logs) and / or communication logs between devices, and transmit the log 501 to the anomaly detection device 200. Furthermore, if the anomaly detection device 200 determines that complete anomaly detection cannot be performed with the log 501 that includes only high-priority columns, it outputs an additional log request 502 to the device group 120 to request that the log 501 be sent with additionally required columns included. This makes it possible to perform anomaly detection with the log 501 that includes only a minimum number of columns, without including all possible columns in the log 501. Therefore, the volume of the log 501 that the device group 120 sends to the anomaly detection device 200 can be reduced, thereby suppressing increases in analysis costs and strain on communication bandwidth, and enabling integrated analysis (anomaly determination) in the anomaly detection device 200 to be performed efficiently.

[0203] Furthermore, for example, the determination results of the anomaly detection device 200 include one or more results obtained by determining whether each of one or more items (columns) included in the first log satisfies a predetermined condition included in each of one or more anomaly determination rules used by the anomaly detection device 200. Furthermore, the log priority calculation device 300 according to this embodiment, for example, calculates a column match rate, which is the proportion of one or more results that are determined to satisfy the predetermined condition, for each of one or more items, in determining the priority, and determines the priority such that items with a lower match rate are more likely to be included in the first log. In other words, the log priority calculation device 300 calculates a column match rate, which is the proportion of one or more items that are determined to satisfy the predetermined condition defined by each of one or more anomaly determination rules, for each of one or more items, among a predetermined number of determination results for each of one or more anomaly determination rules, and determines the log priority such that items with a lower column match rate are more likely to be included in the first log.

[0204] In this way, the log priority calculation device 300 according to this embodiment calculates the column match rate according to the determination results of the anomaly determination that are periodically acquired, determines the log priority based on the column match rate, and then creates and outputs the column list 601. That is, columns with low column match rates are preferentially included in the log 501 and transmitted to the anomaly detection device 200, so that the anomaly detection device 200 can first perform anomaly determination for columns with low column match rates.

[0205] Here, the additional log request 502 may be sent if the result of the anomaly detection indicates that the target column matches the conditions specified in the anomaly detection rule. A low column match rate for a column indicates a low probability that the column matches the conditions specified in the anomaly detection rule. Therefore, by performing anomaly detection for columns with a low column match rate first, the number of times the additional log request 502 is sent can be reduced compared to when anomaly detection is performed for columns with a high column match rate first. As a result, the log priority calculation device 300 determines appropriate log priorities according to the anomaly detection results that change over time, creates a column list 601, and outputs the column list 601 to the device group 120. This allows the analysis accuracy of the anomaly detection device 200 to be maintained, and further reduces the total volume of logs 501 sent to the anomaly detection device 200.

[0206] Next, a modified example of the process of step S731 will be described. Note that in the following description of the modified example, differences from the above embodiment will be mainly described, and descriptions of common configurations and processing procedures may be omitted or simplified.

[0207] (First Modification of the Embodiment) [Processing Procedure] Next, a log priority calculation process according to the first modification of the embodiment will be described.

[0208] 12 is a flowchart showing an example of the log priority calculation process in Modification 1 of this embodiment. Specifically, FIG. 12 is a diagram showing another example of the details of the process of step S731. In Modification 1 of this embodiment, the log priority calculation device 300 calculates the column usage rate for each log type based on the abnormality determination rule stored in the rule storage unit 230, determines the log priority based on the calculated column usage rate, and creates and outputs a column list 601 for each log type based on the determined log priority. Note that in this embodiment, the column usage rate corresponds to the usage rate.

[0209] (S751) The anomaly detection information acquisition unit 310 acquires an anomaly determination rule for a log 501 of an arbitrary log type from the anomaly detection device 200 (specifically, from the rule storage unit 230), and transmits the acquired anomaly determination rule to the log priority determination unit 320. The acquired anomaly determination rule is, for example, an anomaly determination rule as shown in FIG. 5. As described above, in the example of the anomaly determination rule shown in FIG. 5, the log types of all of the logs 501 that are the target of anomaly determination are "device_com_log."

[0210] (S752) The log priority determination unit 320 extracts information about the target columns indicated by the anomaly determination rules acquired in step S751, i.e., the columns used for anomaly determination. Then, for each target column, the log priority determination unit 320 calculates the number of anomaly determination rules that include that target column.

[0211] For example, in Figure 5, the target column is the column shown in Condition along with the condition. For example, the target columns for the abnormality determination rule with ID model-01 are protocol, ip_dst, and nw_status. Furthermore, the target column protocol is included in the abnormality determination rule for model-01 as well as the abnormality determination rule for model-03. Therefore, the number of abnormality determination rules that include this target column is calculated to be two.

[0212] Fig. 13 is a diagram showing an example of a log priority determination process using an abnormality determination rule in Modification 1 of this embodiment. Specifically, Fig. 13 shows a process of determining a log priority for each column and a process of creating a column list 601 when the column usage rate is calculated based on the abnormality determination rule shown in Fig. 5. Note that Fig. 13(a) is a diagram showing an example of the column usage rate, Fig. 13(b) is a diagram showing an example of the log priority calculated from the column usage rate, and Fig. 13(c) is a diagram showing a column list 601 showing the log priority re-determined based on the log priority calculated from the column usage rate and the abnormality determination rule.

[0213] The calculation results of the column usage rate shown in FIG. 13 include, for example, Rule, Rule Count, Used Count, and Rate.

[0214] Rule indicates the ID of the acquired abnormality determination rule.

[0215] The Rule count indicates the number of acquired abnormality determination rules.

[0216] The Used count indicates the number of anomaly determination rules that include each target column.

[0217] The "Rate" indicates the column usage rate for each column. For example, the "Used count" of "Protocol," which is an example of the column to be determined in FIG.

[0218] (S753) The log priority determination unit 320 calculates the column usage rate for the anomaly determination rules based on the number of anomaly determination rules that include each target column calculated in step S752 and the number of acquired anomaly determination rules. For example, the column usage rate is calculated using the following formula (2):

[0219]

[0220] 13, the acquired anomaly determination rules shown in Rule are three rules, model-01, model-02, and model-03, and the Rule count is 3. Therefore, the column usage rate of each determination target column is calculated from the above formula (2) as follows: for protocol, 2 / 3 = 0.667... so it is 66.7%, for ip_src, 1 / 3 = 0.333... so it is 33.3%, for ip_dst, 2 / 3 = 0.667... so it is 66.7%, for nw_status, 1 / 3 = 0.333... so it is 33.3%, and for nw_bytes, 1 / 3 = 0.333... so it is 33.3%.

[0221] (S754) The log priority determination unit 320 determines whether there is a column that satisfies the condition (priority log threshold) defined in advance as a policy, based on the column usage rate of each target column calculated in step S753.

[0222] For example, if the column usage rate condition is set to 50% or more, in other words, if a policy for transmitting columns with a column usage rate of 50% or more is predetermined, then, as shown in FIG. 13A, protocol has a column usage rate of 66.7%, and ip_dst has a column usage rate of 66.7%, both of which satisfy the condition of a column usage rate of 50% or more. Therefore, in this case, the log priority determination unit 320 determines that a column that satisfies the condition exists. If the log priority determination unit 320 determines that a column that satisfies the condition exists (YES in step S754), it proceeds to step S755. If a column that satisfies the condition does not exist (NO in step S754), it proceeds to step S756.

[0223] The condition for the column usage rate is not limited to one, and multiple conditions may be defined. In the case where multiple conditions are defined, for example, the log priority calculation device 300 determines that a column that satisfies the condition exists if any of the conditions is satisfied. Furthermore, the condition may be a predetermined number (for example, two) of columns with high column usage rates.

[0224] (S755) The log priority determination unit 320 determines the log priority for each column based on the conditions and creates a column list 601. In Variation 1 of this embodiment, the log priority determination unit 320 determines the log priorities for columns that satisfy the conditions, i.e., columns whose column usage rate meets the priority log threshold (second priority threshold), in other words, columns whose column usage rate is equal to or greater than the priority log threshold, as first-priority logs with Priority: 0, and columns that do not satisfy the conditions as second-priority logs with Priority: 1, and creates the column list 601. In the example shown in FIG. 13(b), the first-priority logs (Priority: 0) are ip_dst and protocol, and the second-priority logs (Priority: 1) are ip_src, nw_status, and nw_bytes. Note that there may be multiple conditions, two or more priorities may be defined, and multiple priority logs may exist, starting from the third-priority log.

[0225] (S756) The log priority determination unit 320 adds the column indicated as an aggregate parameter in the anomaly determination rule acquired in step S751 to the column list 601 created in step S755 as a first-priority log, i.e., with a Priority indicating log priority of 0. Note that if the column added to the first-priority log is included in the column list 601 as a log other than the first-priority log, the entry for that column other than the first-priority log may be deleted. In this embodiment, the anomaly determination rules acquired in step S751 are the anomaly determination rules for model-01, model-02, and model-03. Of these anomaly determination rules, the anomaly determination rules for model-01 and model-02 indicate that the "ip_src" column is an aggregate parameter. Therefore, the log priority determination unit 320 adds the "ip_src" column to the column list 601 as a first-priority log. In this embodiment, when an aggregation parameter is defined in the abnormality determination rule, the aggregation parameter corresponds to an item essential for abnormality determination.

[0226] (S757) The log priority determination unit 320 compares the target columns (e.g., aggregation parameters) indicated in the anomaly determination rules acquired in step S752 with the column list created in step S755 to determine whether at least one of the target columns for each anomaly determination rule is included in the first-priority log in the created column list 601. If the log priority determination unit 320 determines that at least one of the target columns for each anomaly determination rule is included in the first-priority log in the created column list 601 (YES in step S757), it terminates the log priority calculation process. If the log priority determination unit 320 determines that at least one of the target columns for each anomaly determination rule is not included (NO in step S757), it proceeds to the process of step S758.

[0227] For example, the columns to be judged for the abnormality determination rule of model-01 are Protocol, ip_dst, and nw_status, as shown in FIG. 5. Here, because ip_dst is included in the first-priority log in the column list 601 shown in FIG. 13, the log priority determination unit 320 determines that at least one of the columns to be judged for the abnormality determination rule is included in the first-priority log in the created column list 601. In contrast, the column to be judged for the abnormality determination rule of model-02 is nw_bytes, as shown in FIG. 5. Here, because nw_bytes is not included in the first-priority log in the column list 601 shown in FIG. 13, the log priority determination unit 320 determines that the column to be judged for the abnormality determination rule is not included in the first-priority log in the created column list 601.

[0228] (S758) The log priority determination unit 320 acquires the column with the highest column usage rate from the target column information indicated by the anomaly determination rule for which it was determined in step S757 that the target column is not included in the first-priority log in the created column list 601. For example, if there are multiple columns with the highest column usage rates, the log priority determination unit 320 acquires one of those columns. For example, in the example shown in FIG. 13 , it is determined in step S757 that none of the target columns for the anomaly determination rule for model-02 are included in the first-priority log. Therefore, the log priority determination unit 320 selects and acquires the column with the highest column usage rate, nw_bytes, from among the target columns for the anomaly determination rule for model-02.

[0229] (S759) The log priority determination unit 320 adds the column acquired in step S758 to the column list 601 created in step S755 as the first-priority log, i.e., with Priority indicating the log priority set to 0. Then, the log priority calculation process ends.

[0230] Note that if a column added to the first-priority log is included in the column list 601 as a column other than the first-priority log, the log priority determination unit 320 may delete the entry for that column other than the first-priority log. For example, in the example shown in Figure 13, the nw_bytes column is added as the first-priority log, and the nw_bytes column shown as the second-priority log is deleted. Therefore, as shown in (c) of Figure 13, in the finally created column list 601, the first-priority log (Priority: 0) will be ip_dst, protocol, nw_bytes, and ip_src, and the second-priority log will be nw_status.

[0231] Effect of Modification 1 of Embodiment As described above, in determining the priority, the log priority calculation device 300 according to Modification 2 of the present embodiment, for example, calculates, for each of a plurality of items, a usage rate, which is the proportion of anomaly determination rules that use each of a plurality of items among a plurality of anomaly determination rules, and determines the priority such that an item with a higher usage rate among the plurality of items is more likely to be included in the first log. In other words, the log priority calculation device 300 according to Modification 1 of the present embodiment acquires a plurality of anomaly determination rules used by the anomaly detection device 200, calculates, for each of the plurality of items, the proportion of anomaly determination rules that use each of a plurality of items (columns) included in the device data among the acquired plurality of anomaly determination rules, as a usage rate, and determines the log priority such that an item with a higher usage rate is more likely to be included in the first log.

[0232] In this way, the log priority calculation device 300 according to the first modification of this embodiment periodically acquires the abnormality determination rules that change over time, calculates the column usage rates according to the target columns indicated by the abnormality determination rules, determines the log priorities based on the column usage rates, and then creates and outputs the column list 601.

[0233] Therefore, the device group 120 can prioritize columns with high column usage rates in the log 501 and transmit the log to the anomaly detection device 200. The anomaly detection device 200 can transmit an additional log request 502 when there is a missing column in the anomaly detection, that is, when any of the columns to be determined indicated in the anomaly determination rule is not included in the log 501.

[0234] Here, a high column usage rate for a column included in the log 501 indicates that the column is specified as a target column for determination in more anomaly detection rules. Therefore, when the log 501 includes a column with a high column usage rate, the occurrence of insufficient columns can be reduced overall compared to when the log 501 includes a column with a low column usage rate, and the number of times additional log requests 502 are sent can be reduced. This makes it possible to maintain analysis accuracy by creating and outputting a column list 601 including appropriate log priorities even when the anomaly detection rules change over time, and further reduces the total volume of the log 501 sent to the anomaly detection device 200.

[0235] (Second Modification of the Embodiment) [Processing Procedure] Next, a log priority calculation process according to a second modification of the embodiment will be described.

[0236] 14 is a flowchart showing an example of a log priority calculation process in Modification 2 of this embodiment. In Modification 2 of this embodiment, the log priority calculation device 300 calculates the total amount of log data for a predetermined period (second period) for each log type, determines the log priority based on the total amount of log data, and creates and outputs a column list 601 for each log type. Specifically, the log priority calculation device 300 calculates the total amount of data for each column.

[0237] (S761) The log priority determination unit 320 acquires log information for each column within a predetermined period. Specifically, the anomaly detection information acquisition unit 310 acquires, as log information, information about logs 501 of any log type from the device group 120 for a predetermined period that is stored in the log storage unit 220 of the anomaly detection device 200, and transmits the log information to the log priority determination unit 320. For example, the anomaly detection information acquisition unit 310 acquires from the anomaly detection device 200, among the logs 501 sent by the device group 120 to the anomaly detection device 200 within the predetermined period, logs 501 with a log type of "device_com_log", and transmits the log information to the log priority determination unit 320.

[0238] The log information is, for example, information related to the log 501 stored in the log storage unit 220. The log information may include information used to calculate the total amount of data for each column.

[0239] The log information may be acquired from the log storage unit 220, or may be acquired from the device group 120 or a server that manages device data of the device group 120. The log information acquired by the anomaly detection information acquisition unit 310 is, for example, information such as that shown in Fig. 4. The log acquired by the log priority determination unit 320 and including such log information is an example of a second log.

[0240] The predetermined period may be arbitrarily determined and is not particularly limited. For example, the predetermined period may be the period from when the anomaly detection information acquisition unit 310 acquires the previous log information until when it acquires new log information, or may be the last 10 minutes or the last 1 hour.

[0241] In addition, the log information acquired by the anomaly detection information acquisition unit 310 may be information about the log 501 that includes only some columns based on the log priority, or it may be information about the device data of the IoT device that includes all columns.

[0242] (S762) The log priority determination unit 320 calculates the total amount of data for each column for a predetermined period from the log information acquired in step S761. The calculation of the total amount of data is performed by, for example, converting the data into a data frame and acquiring the memory usage for each column.

[0243] 15 is a diagram showing an example of the total amount of data (total log amount) for each column for a predetermined period in Modification 2 of this embodiment. Specifically, FIG. 15 shows an example of the calculation result of the total amount of data for each column for a predetermined period calculated by the log priority determination unit 320. FIG. 15 shows the total amount of data (size) for each column for a predetermined period; for example, the total amount of data for ip_src is 20 MB, and the total amount of data for port_src is 2 MB.

[0244] FIG. 16 is a diagram illustrating an example of a log priority determination process using the total amount of data for each column in Modification 2 of this embodiment. Specifically, FIG. 16 illustrates a process for determining a log priority for each column and a process for creating a column list 601 when the total amount of data for each column for a predetermined period is calculated as shown in FIG. 15 . For example, the total amount of data for each column is the total amount of data for each column included in the device data recorded by the device group 120 for a predetermined period, or the total amount of data for each column included in the log 501 transmitted by the device group 120 for a predetermined period. Note that (a) of FIG. 16 illustrates an example of the total amount of data for each column, (b) of FIG. 16 illustrates an example of log priorities calculated from the total amount of data, and (c) of FIG. 16 illustrates a column list 601 showing log priorities calculated from the total amount of data and determined based on anomaly determination rules.

[0245] (S763) The log priority determination unit 320 determines whether any column satisfies a condition (priority log threshold) predefined as a policy based on the total data volume for each column calculated in step S762. The condition for the total data volume is set to, for example, 10 MB or less. In other words, the priority log threshold (third priority threshold) is arbitrarily set in advance, such as 10 MB.

[0246] Alternatively, the first priority log may be a predetermined number of columns with a small total amount of data (for example, the bottom three).

[0247] For example, suppose the condition for the total data volume is 10 MB or less and up to three columns with the smallest total data volume are selected as first-priority logs. In other words, assume that a policy is predefined for transmitting columns with a total data volume of 10 MB or less and up to three columns with the smallest total data volume. In this case, as shown in FIG. 16A, the four columns port_src, port_dst, protocol, and nw_status satisfy the condition that the total data volume is 10 MB or less. Therefore, in this case, the log priority determination unit 320 determines that a column that satisfies the condition exists. If the log priority calculation device 300 determines that a column that satisfies the condition exists (YES in step S763), it proceeds to step S764. If no column that satisfies the condition exists (NO in step S763), it proceeds to step S765.

[0248] The condition for the total data amount is not limited to one, and multiple conditions may be defined. In a case where multiple conditions are defined, for example, the log priority calculation device 300 determines that a column that satisfies the condition exists if a column that satisfies any of the conditions exists.

[0249] (S764) The log priority determination unit 320 determines the log priority based on the conditions and creates a column list 601. In Variation 2 of this embodiment, the log priority determination unit 320 determines the log priority by setting columns that satisfy the conditions, i.e., columns whose total data amount satisfies the priority log threshold (third priority threshold), in other words, columns whose total data amount is equal to or less than the priority log threshold, as first-priority logs with Priority: 0, and columns that do not satisfy the conditions as second-priority logs with Priority: 1, and creates the column list 601. Furthermore, in this example, if there are four or more first-priority logs determined in this way, up to three columns with the smallest total data amount are selected as first-priority logs. 16(b), when the bottom three columns of the total data amount for each column are set as the first priority log, the first priority log (Priority: 0) is port_src, protocol, and nw_status, and the second priority log (Priority: 1) is ip_src, ip_dst, port_dst, and nw_bytes. Note that there may be multiple conditions, two or more priorities may be defined, and multiple priority logs may exist from the third priority log onwards.

[0250] (S765) The log priority determination unit 320 acquires anomaly determination rules. Specifically, the log priority determination unit 320 acquires, via the anomaly detection information acquisition unit 310, from the anomaly detection device 200 (specifically, the rule storage unit 230), anomaly determination rules (specifically, information indicating anomaly determination rules) for which the log type indicated in Type is the same as the log type for which the column list 601 is to be created, i.e., the log type of the log acquired in step S761, out of the one or more anomaly determination rules used in the anomaly determination in step S713. In this example, the log priority determination unit 320 acquires three anomaly determination rules, model-01, model-02, and model-03, for which the log type is "device_com_log" and is indicated in Type.

[0251] (S766) The log priority determination unit 320 adds the column indicated as an aggregate parameter in the anomaly determination rule acquired in step S765 to the column list 601 created in step S764 as a first-priority log, i.e., with a Priority indicating log priority of 0. Note that if the column added to the first-priority log is included in the column list 601 as a log other than the first-priority log, the entry for that column other than the first-priority log may be deleted. In this example, the anomaly determination rules acquired in step S765 are the anomaly determination rules for model-01, model-02, and model-03. Of these anomaly determination rules, the anomaly determination rules for model-01 and model-02 indicate that the "ip_src" column is an aggregate parameter. Therefore, the log priority determination unit 320 adds the "ip_src" column to the column list 601 as a first-priority log. In this example, if an aggregation parameter is defined in the abnormality determination rule, the aggregation parameter corresponds to an item that is essential for abnormality determination.

[0252] (S767) The log priority determination unit 320 compares the target columns (e.g., aggregation parameters) indicated in the anomaly determination rules acquired in step S765 with the column list 601 created in step S764 to determine whether at least one of the target columns for each anomaly determination rule is included in the first-priority log in the created column list 601. If the log priority determination unit 320 determines that at least one of the target columns for each anomaly determination rule is included in the first-priority log in the created column list 601 (YES in step S767), it terminates the log priority calculation process. If the log priority determination unit 320 determines that at least one of the target columns for each anomaly determination rule is not included (NO in step S767), it proceeds to the process of step S768.

[0253] For example, the columns to be judged for the abnormality determination rule of model-01 are Protocol, ip_dst, and nw_status, as shown in FIG. 5. Here, nw_status is included in the first-priority log in the column list 601 shown in FIG. 16, so the log priority determination unit 320 determines that at least one of the columns to be judged for the abnormality determination rule is included in the first-priority log in the created column list 601. In contrast, the column to be judged for the abnormality determination rule of model-02 is nw_bytes, as shown in FIG. 5. Here, nw_bytes is not included in the first-priority log in the column list 601 shown in FIG. 16, so the log priority determination unit 320 determines that the column to be judged for the abnormality determination rule is not included in the first-priority log in the created column list 601.

[0254] (S768) The log priority determination unit 320 selects the column with the smallest total data volume from among the columns to be determined as being included in the anomaly determination rule for which it was determined in step S767 that the column to be determined is not included in the first-priority log in the created column list 601. For example, if there are multiple columns with the smallest total data volume, the log priority determination unit 320 selects one of these columns. For example, in the example shown in FIG. 16 , it is determined in step S767 that none of the columns to be determined as being included in the first-priority log for the anomaly determination rule for model-02. Therefore, the log priority determination unit 320 selects and selects the column with the smallest total data volume (nw_bytes) from among the columns to be determined as being included in the anomaly determination rule for model-02.

[0255] (S769) The log priority determination unit 320 adds the column acquired in step S768 to the column list 601 created in step S764 as the first-priority log, i.e., with Priority indicating the log priority set to 0. Then, the log priority calculation process ends.

[0256] Note that if a column added to the first-priority log is included in the column list 601 as a column other than the first-priority log, the log priority determination unit 320 may delete the entry for that column other than the first-priority log. For example, in the example shown in Figure 16, the nw_bytes column is added as the first-priority log, and the nw_bytes column shown as the second-priority log is deleted. Therefore, as shown in (c) of Figure 16, in the finally created column list 601, the first-priority log (Priority: 0) will be port_src, protocol, nw_status, nw_bytes, and ip_scr, and the second-priority log will be ip_dst and port_dst.

[0257] Effect of Modification 2 of the Embodiment As described above, the log priority calculation device 300 according to Modification 2 of the embodiment acquires, for example, a second log including all of the multiple items for each predetermined period (second period), and determines the priority based on the total amount of data for each of the multiple items included in the acquired second log. Specifically, the log priority calculation device 300 according to Modification 2 of the embodiment acquires, for example, the log 501 (or device data) that changes over time, calculates the total amount of data for each column based on the log 501 (or device data) for each predetermined period, determines the log priority based on the total amount of data for each column, and then creates and outputs the column list 601. In other words, the log priority calculation device 300 according to Modification 2 of the embodiment acquires the log 501 (or device data) for each predetermined period and determines the log priority based on the total amount of data for each of the multiple items included in the log 501 (or device data). For example, the log 501 (or device data) includes all of the multiple items (columns) included in the device data recorded by the device group 120.

[0258] Therefore, the device group 120 can prioritize columns with a small total amount of data in the log 501 and transmit the log 501 to the anomaly detection device 200. As a result, even if the trend or total amount of data in the log 501 (or device data) changes over time, the device group 120 can reduce the total volume of the log 501 that the device group 120 transmits to the anomaly detection device 200 by creating a column list 601 including appropriate log priorities and outputting the column list 601 to the device group 120.

[0259] 17 is a flowchart showing an information processing method according to the present embodiment. For example, in an information processing device including a processor and a memory, the processor performs the information processing method described below using the memory. The information processing device is, for example, a log priority calculation device 300.

[0260] (S10) First, the information processing device acquires one or more abnormality determination rules used to determine an abnormality in the device log. Each of the one or more abnormality determination rules includes a predetermined condition that uses one or more items from among multiple items included in the device log.

[0261] The device is, for example, a device included in the device group 120 .

[0262] (S20) Next, the information processing device determines a priority of each of the plurality of items based on the one or more acquired anomaly determination rules. The priority is a degree of priority used to determine which of the plurality of items should be included in the first log transmitted to the analyzer that performs the anomaly determination.

[0263] The analysis device is, for example, an anomaly detection device 200 .

[0264] The priority is, for example, the above-mentioned Priority.

[0265] The abnormality determination rule includes predetermined conditions for determining one or more items. In other words, the predetermined conditions are determination conditions for determining one or more items. The analysis device determines whether the device log is abnormal by determining whether each value of the one or more items satisfies the predetermined conditions included in the abnormality determination rule. In other words, the analysis device determines whether an abnormality has occurred in the device based on the abnormality determination rule and the values ​​corresponding to each of the one or more items.

[0266] (S30) Next, the information processing device outputs the determined priority.

[0267] For example, the information processing device transmits the determined priorities of the multiple items to the device. Based on the received priorities, the device determines one or more items to transmit to the analysis device from among the multiple items stored as logs of the device. For example, the device determines the one or more items according to a predetermined rule according to the priority, such as items with a priority equal to or greater than a threshold, or a predetermined number of items in descending order of priority. The device transmits a log (first log) including the determined one or more items (specifically, values ​​corresponding to the one or more items) to the analysis device. The analysis device determines (detects) the presence or absence of an abnormality based on the one or more items (specifically, values ​​corresponding to the one or more items) included in the received first log and one or more abnormality determination rules.

[0268] The determination result is notified to a user such as the SOC analyst 900 or transmitted to an information processing device. The information processing device, for example, re-determines the priority of each of the multiple items based on the received determination result. For example, if the priority is changed, the information processing device transmits the changed priority to the device. The device re-determines one or more items to transmit to the analysis device based on the received priority.

[0269] By repeating this process, the device can appropriately select items that are important for the analyzer to determine anomalies according to priority and transmit only those important items to the analyzer. Therefore, this information processing method can reduce the amount of log data transmitted to the analyzer while maintaining the accuracy of the log analysis by the analyzer.

[0270] These comprehensive or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized as any combination of a system, a method, an integrated circuit, a computer program, and a recording medium.

[0271] For example, an information processing device according to one aspect of the present disclosure includes: an acquisition unit that acquires one or more abnormality determination rules used to determine an abnormality in a device log; a determination unit that determines a priority of each of the multiple items based on the acquired one or more abnormality determination rules, each of which includes a predetermined condition in which one or more items included in the device log are used; and an output unit that outputs the determined priority, where the priority is a degree used to determine which of the multiple items will be included in a first log to be transmitted to an analysis device that performs abnormality determination.

[0272] The acquisition unit is, for example, the abnormality detection information acquisition unit 310. The acquisition unit executes, for example, step S10.

[0273] The determination unit is, for example, the log priority determination unit 320. The determination unit executes, for example, step S20.

[0274] The output unit is, for example, the output unit 340. The output unit executes, for example, step S30.

[0275] (Other Embodiments) Although the information processing device and the like according to the present disclosure have been described above based on the embodiments and modifications, the present disclosure is not limited to the above-described embodiments and modifications.

[0276] For example, the first period and the second period may be the same period (e.g., the same time length and the same timing) or may be different periods. Furthermore, the first priority threshold, the second priority threshold, and the third priority threshold may be the same value or may be different values.

[0277] For example, the present disclosure may be embodied as the above-described methods. Furthermore, the present disclosure may be embodied as a computer program for implementing these methods on a computer, or as a digital signal comprising a computer program. For example, one aspect of the present disclosure may be a computer program for causing a computer to execute each of the characteristic steps included in the log priority calculation method.

[0278] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0279] The present disclosure may also be applied to transmitting a computer program or digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0280] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0281] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0282] Furthermore, the above-described embodiments and modifications may be combined with each other. Furthermore, various modifications that a person skilled in the art may conceive of may be made to the present embodiment, and configurations constructed by combining components of different embodiments may also be included in the present disclosure, as long as they do not deviate from the spirit of the present disclosure.

[0283] The present disclosure is useful for an apparatus for reducing the amount of logs when sending logs related to equipment to an analysis device for anomaly analysis.

[0284] DESCRIPTION OF SYMBOLS 110 Site 120 Device group 200 Anomaly detection device 210 Determination result storage unit 220 Log storage unit 230 Rule storage unit 240 Anomaly determination unit 250 Communication unit 260 Output unit 300 Log priority calculation device 310 Anomaly detection information acquisition unit 320 Log priority determination unit 330 Log priority storage unit 340 Output unit 400 Log analysis system 501 Log 601 Column list 701 Alert 900 SOC analyst

Claims

1. An information processing method executed by a computer, comprising: acquiring one or more abnormality determination rules used for abnormality determination of an equipment log, each of the one or more abnormality determination rules including a predetermined condition in which one or more items of a plurality of items included in the equipment log are used; determining a priority of each of the plurality of items based on the one or more acquired abnormality determination rules, the priority being a degree for determining which of the plurality of items are to be included in a first log transmitted to an analytical device that performs the abnormality determination; and outputting the determined priority.

2. The information processing method according to claim 1, wherein the log of the device is a communication log of the device or an operation log of the device.

3. The information processing method of claim 1, further comprising: storing the determined priority; determining the priority for each predetermined first period; and outputting the priority by outputting the determined priority when there is a change in any of the determined priorities for each of the plurality of items from the stored priority for each of the plurality of items.

4. The information processing method according to claim 3, wherein, in outputting the priority, only the priority of items that has changed from the stored priority of each of the plurality of items is output, out of the priority of each of the plurality of items that has been determined.

5. The information processing method according to claim 1, further comprising storing the one or more acquired abnormality judgment rules, and determining the priority when at least a portion of the one or more re-acquired abnormality judgment rules has changed from the one or more stored abnormality judgment rules.

6. The information processing method of claim 1, wherein the priority is one of at least two levels including a degree indicating that each of the plurality of items is to be included in the first log and a degree indicating that each of the plurality of items is not to be included in the first log.

7. The information processing method of claim 6, wherein in determining the priority, the priority of at least one item among the one or more items used in the specified conditions included in each of the one or more acquired anomaly judgment rules is determined to a degree that indicates inclusion in the first log.

8. The information processing method according to claim 6, wherein the analysis device classifies the first logs into a plurality of groups using specified items and performs the abnormality determination for each group, and in determining the priority, the priority is determined so that the priority of the specified items is a degree that indicates inclusion in the first log.

9. An information processing method according to any one of claims 1 to 8, further comprising obtaining a result of the abnormality judgment of the first log executed using the one or more abnormality judgment rules, and determining the priority based on the judgment result.

10. The information processing method of claim 9, wherein the judgment result includes one or more results obtained by judging whether or not each of the one or more items to be included in the first log satisfies the specified condition included in each of the one or more anomaly judgment rules, and the priority is determined by calculating a match rate, which is the proportion of the one or more results that are judged to satisfy the specified condition, for each of the one or more items, and determining the priority such that an item with a lower match rate among the one or more items is more likely to be indicated for inclusion in the first log.

11. An information processing method according to any one of claims 1 to 8, wherein the one or more abnormality determination rules are a plurality of abnormality determination rules, and in determining the priority, a usage rate which is the proportion of abnormality determination rules in which each of the plurality of items is used among the plurality of abnormality determination rules is calculated for each of the plurality of items, and the priority is determined such that an item having a higher usage rate among the plurality of items is more likely to be indicated for inclusion in the first log.

12. An information processing method as described in any one of claims 1 to 8, further comprising obtaining a second log including all of the plurality of items for each specified second period, and determining the priority based on the total amount of data for each of the plurality of items included in the obtained second log.

13. An information processing device comprising: an acquisition unit that acquires one or more abnormality judgment rules used for abnormality judgment of an equipment log; each of the one or more abnormality judgment rules including a predetermined condition in which one or more items among a plurality of items included in the equipment log are used; a determination unit that determines a priority of each of the plurality of items based on the one or more acquired abnormality judgment rules; the priority being a degree for determining which of the plurality of items are to be included in a first log to be transmitted to an analytical device that performs the abnormality judgment; and an output unit that outputs the determined priority.

14. A program for causing a computer to execute an information processing method, which includes: acquiring one or more anomaly judgment rules used for anomaly judgment in an equipment log, each of the one or more anomaly judgment rules including a predetermined condition in which one or more items among a plurality of items included in the equipment log are used; determining a priority of each of the plurality of items based on the one or more acquired anomaly judgment rules, the priority being a degree for determining which of the plurality of items are to be included in a first log transmitted to an analytical device that performs the anomaly judgment; and outputting the determined priority.

Images