Detection device and detection method

Abstract

A detection device (100) comprises an acquisition unit (121) and an abnormal communication determination unit (122). The acquisition unit (121) acquires communication data of a monitored device. The abnormal communication determination unit (122) uses the communication data acquired by the acquisition unit (121) to determine abnormal communication on the basis of the difference between a communication state before a vulnerability of the monitored device was found and a communication state after the vulnerability was found.

Description

Detection device and detection method

[0001] The present invention relates to a detection device and a detection method.

[0002] As modern IT / IoT / OT devices become more sophisticated, the software inside the devices is no longer developed in-house, but is instead developed efficiently by combining various open source software, such as general-purpose operating systems and libraries.

[0003] However, if a vulnerability is discovered in the software used in combination, attackers may exploit the vulnerability to invade or tamper with the device, which could result in information leakage. For this reason, it is important to regularly check for vulnerabilities in the software used in the device, and to take immediate action if a vulnerability is discovered.

[0004] Tomokatsu Takahashi, Tomoki Yamanaka, Takuya Minami, Yoshiaki Nakajima, "Effectiveness of Anomaly Detection Technology Using BERT-Based Feature Extraction for Packet Payload," Proceedings of the 2023 Annual Conference of the Japanese Society for Artificial Intelligence, Vol. 37, 2023, Session ID 1T5-GS-2-03, p. 1T5GS203, Published July 10, 2023 https: / / www.jstage.jst.go.jp / article / pjsai / JSAI2023 / 0 / JSAI2023_1T5GS203 / _pdf. NetFlow Analyzer (Zoho Japan) https: / / www.manageengine.jp / products / NetFlow_Analyzer / protocol-and-application-monitoring.html (Retrieved January 11, 2024)

[0005] However, conventional technologies may not be able to properly detect attacks that exploit vulnerabilities in devices. For example, conventional technologies can use machine learning models to detect unusual communications as anomalous communications, but it is difficult to identify whether the anomalous communications are attacks that exploit vulnerabilities. Similarly, even when rule-based detection methods are used, it is difficult to identify whether the detected anomalous communications are attacks that exploit vulnerabilities.

[0006] In order to solve the above-mentioned problems and achieve the objectives, the detection device of the present invention is characterized by having an acquisition unit that acquires communication data of the monitored device, and an abnormal communication determination unit that uses the communication data acquired by the acquisition unit to determine abnormal communication based on the difference between the communication situation before a vulnerability in the monitored device is discovered and the communication situation after the vulnerability is discovered.

[0007] The present invention provides an advantage that attacks that exploit vulnerabilities in devices can be appropriately detected.

[0008] FIG. 1 is a diagram illustrating an anomalous communication detection system according to an embodiment. FIG. 2 is a diagram illustrating an example of the configuration of a detection device and a vulnerability management device according to an embodiment. FIG. 3 is a diagram illustrating an example of data stored in a detection device according to an embodiment. FIG. 4 is a diagram illustrating an example of data stored in a detection device according to an embodiment. FIG. 5 is a diagram illustrating an example of data stored in a detection device according to an embodiment. FIG. 6 is a diagram illustrating a specific example of processing by an anomalous communication determination unit when a machine learning method according to an embodiment is used. FIG. 7 is a diagram illustrating a specific example of processing by an anomalous communication determination unit when a rule-based method according to an embodiment is used. FIG. 8 is a diagram illustrating a specific example of overall processing of an anomalous communication detection system according to an embodiment. FIG. 9 is a flowchart illustrating an example of the overall flow of anomalous communication detection processing according to an embodiment. FIG. 10 is a diagram illustrating an example of the configuration of a computer that realizes a detection device or a vulnerability management device according to an embodiment.

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of a detection device and a detection method according to the present invention will be described in detail below with reference to the accompanying drawings. However, the detection device and the detection method according to the present invention are not limited to these embodiments.

[0010] [1. Introduction] (1-1. Overview of Prior Art) First, an overview of the prior art in the anomalous communication detection technology according to this embodiment will be described. Modern IT / IoT / OT devices are efficiently developed by combining various open source software. However, if a vulnerability is discovered in the combined software, there is a risk that an attacker could exploit the vulnerability to invade or tamper with the device. Therefore, it is important to regularly check for vulnerabilities and, if a vulnerability is discovered, to take immediate action.

[0011] However, it takes a certain amount of time before countermeasures can be implemented, as it is necessary to establish countermeasures for discovered vulnerabilities, confirm the adverse effects of the countermeasures on operational devices, etc. Therefore, it is necessary to appropriately detect attacks that exploit vulnerabilities during the period when countermeasures are not yet implemented, when there is a high possibility that the vulnerabilities will be exploited.

[0012] Known prior art techniques include machine learning-based anomaly detection and rule-based anomaly detection. Machine learning-based anomaly detection uses machine learning to learn the state of communication when device communication is normal, and generates a detection model. The generated detection model is then used to monitor device communication, and communication that differs from normal communication by a certain amount or more is determined to be anomalous. On the other hand, rule-based anomaly detection uses preset monitoring items and thresholds to determine anomalous communication based on whether the monitoring items exceed the thresholds.

[0013] However, even if both of the above-mentioned conventional technologies detect anomalous communication, they are unable to determine whether the communication is normal (commonly performed and unlikely to be related to vulnerabilities) or an attack that exploits vulnerabilities. In other words, the conventional technologies may not be able to properly detect attacks that exploit vulnerabilities.

[0014] (1-2. Overview of the detection device according to this embodiment) The detection device according to this embodiment was invented with the aim of solving the above-mentioned problems, and has the effect of being able to appropriately detect attacks that exploit vulnerabilities.

[0015] Next, a detection device according to the present embodiment will be described. FIG. 1 is a diagram showing an anomalous communication detection system according to the embodiment. The system shown in FIG. 1 includes a detection device 100, a vulnerability management device 200, a plurality of monitored devices 300, and a communication device 400, and transmits and receives information via wired or wireless connections via the Internet or the like. Note that the system shown in FIG. 1 is an example, and the number of monitored devices 300 and communication devices 400 is not particularly limited. Furthermore, the functions of each device may be included in another device. For example, the detection device 100 may include the functions of the vulnerability management device 200.

[0016] The detection device 100 is, for example, a server device that stores communication data of the monitored device 300 acquired from the communication device 400 and performs processing to detect anomalous communication, and is realized by a computer or the like. The detection device 100 is also connected to the vulnerability management device 200, for example, via a wired or wireless connection, and receives instructions to strengthen communication monitoring based on the presence or absence of vulnerabilities and transmits the detection results of anomalous communication.

[0017] The vulnerability management device 200 is a server device, implemented by a computer, that collects, for example, software configuration information of the monitored device 300 and vulnerability information disclosed in the public via the Internet or the like, and determines whether or not there are vulnerabilities in the monitored device 300. Furthermore, when a vulnerability is discovered in the monitored device 300, the vulnerability management device 200 instructs the detection device 100 to strengthen communication monitoring based on the presence or absence of the vulnerability, and notifies an administrator or the like of the detection result of anomalous communication received from the detection device 100.

[0018] The monitored device 300 is a device that is the target of anomalous communication detection by the detection device 100, and is realized by an information processing terminal such as a computer. The communication device 400 is a device that connects the monitored device 300 to the Internet or the like, and is realized by a router device or the like.

[0019] The following describes the processing performed by the detection device 100 according to this embodiment. The detection device 100 acquires communication data from a device to be monitored, and uses the acquired communication data to determine whether communication is abnormal based on the difference between the communication status before a vulnerability in the device to be monitored was discovered and the communication status after the vulnerability was discovered.

[0020] For example, the detection device 100 acquires communication data of the monitored device 300 from the communication device 400 by packet mirroring. Then, the detection device 100 identifies the time when the vulnerability in the monitored device 300 was discovered, for example, using information regarding the presence or absence of vulnerabilities received from the vulnerability management device 200. Thereafter, the detection device 100 monitors the communication status after the vulnerability was discovered, using a machine learning model trained using communication data before the vulnerability was discovered. Then, when the detection device 100 detects a communication status that differs by a certain amount from the communication status before the vulnerability was discovered, it determines that anomalous communication has been detected.

[0021] This allows the detection device 100 to compare the communication status before and after the discovery of a vulnerability and determine abnormal communication based on the difference, thereby enabling it to appropriately detect attacks that exploit vulnerabilities that are specifically detected after the vulnerability is discovered.

[0022] 2. Configuration of Detection Device and Vulnerability Management Device Next, the configurations of the detection device 100 and vulnerability management device 200 shown in FIG. 1 will be described with reference to FIG. 2. FIG. 2 is a diagram showing an example configuration of a detection device and a vulnerability management device according to an embodiment. Below, the functional configurations of the detection device 100 and the vulnerability management device 200 according to this embodiment will be described in order.

[0023] (2-1. Functional Configuration of the Detection Device 100) First, the functional configuration of the detection device 100 will be described. The communication unit 110 is realized by, for example, a network interface card (NIC). The communication unit 110 is connected to the vulnerability management device 200 and the communication devices 400, and transmits and receives information to and from each of these devices. For example, the communication unit 110 receives instructions from the vulnerability management device 200 to strengthen communication monitoring based on the presence or absence of vulnerabilities, and mediates the acquisition process of communication data from the communication devices 400 by the acquisition unit 121, which will be described later.

[0024] The storage unit 130 is realized by a storage device such as a RAM (Random Access Memory) or a hard disk, for example. The storage unit 130 stores data and programs necessary for various processes performed by the control unit 120. The storage unit 130 includes a communication data storage unit 131 and a monitoring item data storage unit 132, which are closely related to the present invention.

[0025] The communication data storage unit 131 stores communication data of the monitored device 300 acquired by the acquisition unit 121, which will be described later. Here, the data stored in the communication data storage unit 131 will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of data stored in the detection device according to the embodiment.

[0026] As shown in FIG. 3, the communication data storage unit 131 stores, for example, the "target device," "acquisition time," "communication source / destination (total unique number)," "communication source / destination (by country)," "communication volume," "number of sessions," "number of errors," and "number of TCP connection failures."

[0027] For example, "target device" stores information that can identify the monitored device 300, such as the device name and ID of the monitored device 300, and "acquisition time" stores the time when the communication data was acquired. Also, "source / destination (total unique number)" stores the ratio of the source IP address to the total unique number of destination IP addresses, and "source / destination (by country)" stores the ratio of the source IP address to the total unique number of destination IP addresses by country.

[0028] The communication data storage unit 131 also stores numerical values ​​of communication data for pre-set monitoring items such as "communication volume," "number of sessions," "number of errors," and "number of TCP connection failures." Note that the content of the data stored in the communication data storage unit 131 is not limited to the information shown in Fig. 3, and the unit 131 can store numerical values ​​of communication data for monitoring items arbitrarily set by the administrator.

[0029] The monitoring item data storage unit 132 stores information about monitoring items for which differences are to be calculated, which is used in the difference determination process by the anomalous communication determination unit 122 (described later). The data stored in the monitoring item data storage unit 132 will now be described with reference to Figures 4 and 5. Figures 4 and 5 are diagrams showing an example of data stored in the detection device according to this embodiment.

[0030] First, a list containing monitoring items and difference determination targets specific to software held by the monitored device 300 will be described with reference to Fig. 4. As shown in Fig. 4, the monitoring item data storage unit 132 stores the items "software name," "protocol to be monitored," "port number to be monitored," and "determination target" in list format.

[0031] "Software name" stores the name of the software owned by the monitored device 300. "Monitored protocol" and "Monitored port number" store the protocol and port number specific to the corresponding software, respectively. "Judgment target" stores the monitoring item that is the target for calculating the difference in the processing of the anomalous communication judgment unit 122, which will be described later.

[0032] For example, the monitoring item data storage unit 132 stores, for "Software name: Apache," the monitored protocols as "http, https" and the monitored port numbers as "80, 443," and stores that the monitoring item "communication volume" is used to determine the difference for "Apache."

[0033] Next, referring to Fig. 5, a list is stored that lists the IP addresses of monitored countries and the corresponding items to be judged. As shown in Fig. 5, the monitoring item data storage unit 132 stores, for example, items such as "Monitored IP Address (by Country)" and "Judgment Target" in list format. "Monitored IP Address (by Country)" stores IP addresses set for each monitored country. Furthermore, "Judgment Target" stores the monitoring items set as targets for judgment of differences for the data of the corresponding IP address.

[0034] For example, the monitoring item data storage unit 132 stores that for "Monitored IP addresses (by country): IPs in Country A," the monitoring items "Number of unique IP addresses accessed" and "Communication volume" are used to determine the difference.

[0035] Returning to the explanation of Fig. 2, the control unit 120 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing various programs stored in a storage device within the device using RAM as a work area. The control unit 120 is also realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 120 has an acquisition unit 121 and an abnormal communication determination unit 122.

[0036] The acquisition unit 121 acquires communication data of the monitored device. For example, in a situation where the monitored device 300 is connected to the Internet via the communication device 400 and is transmitting and receiving information, the acquisition unit 121 acquires the communication data of the monitored device 300 from the communication device 400 by packet mirroring. Then, the acquisition unit 121 stores the numerical values ​​of each item shown in FIG. 3 for the acquired communication data in the communication data storage unit 131.

[0037] The anomalous communication determination unit 122 determines anomalous communication based on the difference between the communication status before a vulnerability in the monitored device was discovered and the communication status after the vulnerability was discovered, using the communication data acquired by the acquisition unit 121. For example, the anomalous communication determination unit 122 identifies the time when a vulnerability in the monitored device 300 was discovered, based on information regarding the presence or absence of a vulnerability notified by the vulnerability management device 200 and information regarding the time when the vulnerability was discovered.

[0038] The anomalous communication determination unit 122 then calculates the difference in the monitoring items to be determined stored in the monitoring item data storage unit 132 between communication data obtained after the discovery of the vulnerability to be determined and communication data obtained before the discovery of the vulnerability to be compared, and determines that the communication data obtained after the discovery of the vulnerability is anomalous communication if the difference exceeds a preset threshold. Note that, for example, if there is a monitoring item related to communication specific to the software in which the vulnerability has been found, the anomalous communication determination unit 122 can selectively use that monitoring item as the target for determination.

[0039] The abnormal communication determination unit 122 can determine whether the similarity between the communication data before the vulnerability was discovered and the communication data after the vulnerability was discovered, output by a machine learning model that has been trained on the communication data before the vulnerability was discovered, is below a predetermined threshold.

[0040] Here, the processing content of the anomalous communication determination unit when a machine learning model is used will be described with reference to Fig. 6. Fig. 6 is a diagram showing a specific example of the processing of the anomalous communication determination unit when a machine learning method according to an embodiment is used. Fig. 6 shows an example of a method for generating a machine learning model before and after the disclosure (discovery) of a vulnerability and for determining anomalous communication using the generated learning model.

[0041] First, before a vulnerability in the monitored device 300 is made public, the detection device 100 generates multiple detection models for determining anomalous communication by learning communication data for a certain period of time each day. After that, the vulnerability is made public by an external vulnerability database or the like, and the vulnerability management device 200 notifies the detection device 100 that a vulnerability exists in the monitored device 300.

[0042] In this case, the anomalous communication determination unit 122 selects a detection model that has learned communication data up until immediately before the vulnerability was disclosed. Then, using the selected detection model, the anomalous communication determination unit 122 calculates the similarity between the communication data after the vulnerability was disclosed and the learned communication data before the vulnerability was disclosed, and if the similarity is equal to or less than a threshold (there is a difference of a certain amount or more), determines that the communication data after the vulnerability was disclosed is anomalous communication.

[0043] Through the series of processes described above, the anomalous communication determination unit 122 can determine anomalous communication based on the similarity of the communication data before and after the vulnerability is disclosed, and therefore the detection device 100 can appropriately detect attacks that exploit vulnerabilities that are carried out after the vulnerability is disclosed.

[0044] The machine learning model described above may be set to output a dissimilarity ratio instead of a similarity ratio, and anomalous communication may be detected based on whether the dissimilarity ratio is equal to or greater than a threshold. Furthermore, the learning data of the machine learning model selected by the anomalous communication determination unit 122 is not particularly limited. For example, if attacks exploiting a vulnerability have been detected before the vulnerability was discovered, a machine learning model trained using communication data from before the first attack exploiting the vulnerability was confirmed may be selected.

[0045] The abnormal communication determination unit 122 can determine whether the difference between the numerical value of a specified monitoring item based on communication data before a vulnerability was discovered and the numerical value of the communication data after the vulnerability was discovered is greater than or equal to a specified threshold.

[0046] Here, the processing content of the anomalous communication determination unit when the rule-based method is used will be described with reference to Fig. 7. Fig. 7 is a diagram showing a specific example of the processing of the anomalous communication determination unit when the rule-based method according to the embodiment is used. Fig. 7 shows an example of a method for determining anomalous communication by acquiring communication data before and after the publication (discovery) of a vulnerability and using the numerical values ​​of the monitoring items in the acquired communication data.

[0047] First, even before a vulnerability in the monitored device 300 is made public, the detection device 100 acquires communication data daily and stores the numerical values ​​of preset monitoring items in the communication data storage unit 131. After that, the vulnerability is made public by an external vulnerability database or the like, and the vulnerability management device 200 notifies the detection device 100 that the vulnerability exists in the monitored device 300.

[0048] The anomalous communication determination unit 122 then compares the numerical values ​​of the monitoring items before the vulnerability was disclosed with the current (after the vulnerability was disclosed) numerical values ​​of the monitoring items to calculate a difference. If the difference is equal to or greater than a preset threshold, the anomalous communication determination unit 122 determines that the current (after the vulnerability was disclosed) communication situation is anomalous. More specifically, for example, if the ratio of the number of IP addresses in a specific country to the total number of IP addresses before the vulnerability was disclosed was 20% and was 50% after the vulnerability was disclosed, the anomalous communication determination unit 122 calculates that the difference is 30%, determines that the difference is equal to or greater than the threshold of 20%, and determines that the communication situation after the vulnerability was disclosed is anomalous.

[0049] Through the series of processes described above, the anomalous communication determination unit 122 can determine anomalous communication by comparing the numerical values ​​of specific monitoring items in the communication data before and after the vulnerability is made public, and therefore the detection device 100 can appropriately detect attacks that exploit the vulnerability after the vulnerability is made public.

[0050] Furthermore, countermeasures against attacks that exploit vulnerabilities can be implemented based on the details of the anomalous communication detected by the detection device 100. For example, if the detection device 100 detects anomalous communication indicating an increase in access from a specific country after a vulnerability is made public, the detection device 100 can implement countermeasures such as temporarily setting up a firewall to block communication from a specific IP address until the vulnerability is addressed.

[0051] Although the processing contents of the anomalous communication determination unit 122 have been described using two methods, the machine learning method and the rule-based method, the processing is not limited to either of these methods. For example, under normal circumstances, anomalous communication determination can be performed using only the rule-based method, and when a vulnerability is discovered, anomalous communication determination can be performed using a combination of both the rule-based method and the machine learning method.

[0052] (2-2. Functional Configuration of the Vulnerability Management Device 200) Next, the functional configuration of the vulnerability management device 200 will be described. The communication unit 210 is realized by, for example, a network interface card (NIC). The communication unit 210 is connected to, for example, the detection device 100, the monitored device 300, and the Internet, and transmits and receives information to and from each of these devices. The communication unit 210, for example, collects software bill of materials (SBOM) information from the monitored device 300, collects information held in a vulnerability database on the Internet, and mediates the process of notifying an administrator of the detection of anomalous communication.

[0053] The storage unit 230 is realized by a storage device such as a RAM (Random Access Memory) or a hard disk, for example. The storage unit 230 stores data and programs necessary for various processes by the control unit 220. The storage unit 230 appropriately stores information used to determine the presence or absence of vulnerabilities, such as vulnerability information in the market and SBOM information of the monitored devices 300, collected by the collection unit 221 (described later).

[0054] The control unit 220 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing various programs stored in a storage device within the device using RAM as a work area. The control unit 220 is also realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 220 has a collection unit 221, a vulnerability determination unit 222, and a notification unit 223.

[0055] The collection unit 221 collects vulnerability information available in the market and information related to the software configuration of the monitored device 300. For example, the collection unit 221 periodically collects information related to software vulnerabilities that has been published in an external vulnerability database on the Internet, and stores the information in the storage unit 230. The collection unit 221 also collects configuration information of the software owned by the monitored device 300, for example, from the SBOM information of the monitored device 300, and stores the information in the storage unit 230.

[0056] The vulnerability determination unit 222 determines whether or not a vulnerability exists in the software owned by the monitored device 300, based on the information collected by the collection unit 221. For example, the vulnerability determination unit 222 periodically determines whether or not a vulnerability exists in the software owned by the monitored device 300, by comparing the name of software in which a vulnerability has been discovered, which is listed in vulnerability information available on the market, with the name of the software listed in the SBOM information of the monitored device 300.

[0057] When the vulnerability determination unit 222 determines that a vulnerability exists in the software held by the monitored device 300, the notification unit 223 notifies the detection device 100 of information relating to the software in which the vulnerability has been found.

[0058] For example, when it is determined that a vulnerability exists in software owned by the monitored device 300, the notification unit 223 notifies the detection device 100 of an instruction to strengthen communication monitoring, together with information such as the name of the monitored device 300 in which the vulnerability was discovered, the name of the software, and the time when the vulnerability was made public. In this case, when the detection device 100 receives an instruction to strengthen communication monitoring from the vulnerability management device 200, it performs the processing of the anomalous communication determination unit 122 described above.

[0059] Furthermore, when the notification unit 223 receives a notification from the detection device 100 that anomalous communication has been detected, it notifies the administrator's terminal of the communication data of the anomalous communication and information on a vulnerability discovered in the monitored device 300. For example, when the notification unit 223 receives an alert from the detection device 100 that anomalous communication has been detected, the communication data, and information on the monitored device 300, it notifies the administrator's computer or the like of the received information and information such as the publication date of the discovered vulnerability.

[0060] 8, a description will be given of the overall processing flow of the anomaly detection system including the above-described detection device 100 and vulnerability management device 200. Fig. 8 is a diagram illustrating a specific example of the overall processing of the anomalous communication detection system according to the embodiment.

[0061] First, the detection device 100 constantly monitors the communications of the monitored device 300 by, for example, acquiring communication packets of the monitored device 300 from the communication device 400 by packet mirroring ((1) in FIG. 8). The vulnerability management device 200 collects SBOM information and the like of the monitored device 300 to grasp software configuration information of the monitored device 300 ((2) in FIG. 8). Furthermore, the vulnerability management device 200 periodically collects information about vulnerabilities published in vulnerability information databases and the like on the Internet to grasp the latest vulnerability information ((3) in FIG. 8).

[0062] Next, the vulnerability management device 200 periodically determines whether the monitored device 300 has vulnerable software, for example, based on the collected software configuration information and vulnerability information ((4) in FIG. 8). If a vulnerability is found in the software owned by the monitored device 300, the vulnerability management device 200 issues a command to strengthen monitoring of the communication content of the monitored device 300 ((5) in FIG. 8).

[0063] Thereafter, in response to receiving an instruction to strengthen communication monitoring, the detection device 100 performs a process of determining anomalous communication using a machine learning method or a rule-based method ((6) in FIG. 8). If the detection device 100 determines that the acquired communication data is anomalous, it notifies the vulnerability management device 200 that it has detected anomalous communication and provides related information ((7) in FIG. 8). Thereafter, the vulnerability management device 200 notifies the administrator's computer of the communication data of the anomalous communication and information related to vulnerabilities notified by the detection device 100 ((8) in FIG. 8).

[0064] Through the series of processes described above, the anomalous communication detection system shown in FIG. 8 strengthens communication monitoring when software with a disclosed vulnerability is present in the monitored device 300, and can appropriately detect anomalous communication (attacks that exploit the vulnerability) detected after the vulnerability is disclosed, and can notify the administrator of the detection results.

[0065] 4. Example of Anomalous Communication Detection Processing Next, the overall flow of processing performed by the anomalous communication detection system will be described with reference to FIG. 9. FIG. 9 is a flowchart showing an example of the overall flow of anomalous communication detection processing according to the embodiment. Note that the steps in the flowchart shown in FIG. 9 may be executed in a different order, and some processing may be omitted. Furthermore, the flowchart shown in FIG. 9 shows an example of the processing flow from the discovery of specific vulnerability information to the completion of countermeasures, and the series of processing is assumed to be periodically repeated.

[0066] The acquisition unit 121 of the detection device 100 acquires communication data of the monitored device (S101). The collection unit 221 of the vulnerability management device 200 collects software configuration information of the monitored device and vulnerability information in the market (S102). The vulnerability determination unit 222 of the vulnerability management device 200 then determines whether or not there is a vulnerability in the software of the monitored device (S103).

[0067] If a vulnerability exists in the software of the device to be monitored (S103; Yes), the notification unit 223 of the vulnerability management device 200 notifies the detection device 100 of information on the vulnerable software, the time the vulnerability was discovered, and an instruction to strengthen monitoring of the device to be monitored (S104).On the other hand, if no vulnerability exists in the software of the device to be monitored (S103; No), the anomalous communication monitoring system returns to S101 and continues processing.

[0068] After S104, the anomalous communication determination unit 122 of the detection device 100 determines whether the communication status based on the acquired communication data is anomalous based on the difference between the communication status before and after the vulnerability was discovered (S105). If it is determined that the communication status is anomalous (S106; Yes), the notification unit 223 of the vulnerability management device 200 notifies the administrator of the communication data of the anomalous communication and the vulnerability information (S107).

[0069] If the communication status is not determined to be anomalous (S106; No), or after the processing of S107, the vulnerability management device 200 determines whether it has confirmed that vulnerability countermeasures have been implemented for the device or whether it has received an external input to stop enhanced monitoring (S108). If neither confirmation that vulnerability countermeasures have been implemented for the device nor an input to stop enhanced monitoring has been received (S108; No), the process returns to S105 and continues. On the other hand, if it has confirmed that vulnerability countermeasures have been implemented for the device or an input to stop enhanced monitoring has been received (S108; Yes), the notification unit 223 of the vulnerability management device 200 notifies the detection device 100 that it will return to a normal monitoring state (S109), and the anomalous communication detection system ends the processing steps from the discovery of specific vulnerability information to the completion of the countermeasures. Note that the confirmation process of whether vulnerability countermeasures have been implemented for the device in S108 can be determined, for example, by re-checking the updated software configuration information and vulnerability information of the device after the update when the software configuration of the device has been updated.

[0070] 5. Effects of the Embodiment As described above, the detection device 100 according to the present embodiment includes the acquisition unit 121 and the anomalous communication determination unit 122. The acquisition unit 121 acquires communication data of a device to be monitored. The anomalous communication determination unit 122 uses the communication data acquired by the acquisition unit 121 to determine anomalous communication based on the difference between the communication status before a vulnerability in the device to be monitored was discovered and the communication status after the vulnerability was discovered.

[0071] This allows the detection device 100 to detect anomalous communication based on the difference in communication conditions before and after the discovery of a vulnerability, thereby enabling it to appropriately detect attacks that exploit vulnerabilities that occur after the vulnerability is discovered.

[0072] In addition, the abnormal communication determination unit 122 of the detection device 100 determines whether the similarity between the communication data before the vulnerability was discovered and the communication data after the vulnerability was discovered, output by a machine learning model that has been trained on the communication data before the vulnerability was discovered, is below a predetermined threshold.

[0073] As a result, the detection device 100 can determine that specific communications after the vulnerability is discovered are abnormal communications using a machine learning model that has been trained only on communication data before the vulnerability was discovered, making it easier to detect attacks that exploit vulnerabilities.

[0074] In addition, the abnormal communication determination unit 122 of the detection device 100 determines whether the difference between the numerical value of a specified monitoring item based on communication data before the vulnerability was discovered and the numerical value of the communication data after the vulnerability was discovered is greater than or equal to a specified threshold.

[0075] As a result, the detection device 100 determines abnormal communication from the difference in the numerical values ​​of specific monitoring items for communication data for a certain period before and after the discovery of the vulnerability, and can selectively determine monitoring items for communications specific to the software in which the vulnerability has been made public, thereby efficiently detecting attacks that exploit vulnerabilities.

[0076] [6. System Configuration, etc.] Of the processes described in the above embodiments, some of the processes described as being performed automatically can also be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

[0077] Furthermore, the components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0078] 2 may be stored in a storage server or the like, instead of being stored in the detection device 100 or the vulnerability management device 200. In this case, the detection device 100 or the vulnerability management device 200 accesses the storage server to acquire various pieces of information.

[0079] 7. Hardware Configuration Fig. 10 is a diagram illustrating an example of a hardware configuration. The detection device 100 or the vulnerability management device 200 according to the above-described embodiments is realized by, for example, a computer 1000 having the configuration shown in Fig. 10.

[0080] 10 is a diagram showing an example of the configuration of a computer that realizes a detection device or a vulnerability management device according to an embodiment. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0081] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0082] The hard disk drive 1090 stores, for example, an operating system (OS) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the detection device 100 or the vulnerability management device 200 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the detection device 100 or the vulnerability management device 200 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0083] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0084] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may instead be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0085] REFERENCE SIGNS LIST 100 Detection device 110, 210 Communication unit 120, 220 Control unit 121 Acquisition unit 122 Abnormal communication determination unit 130, 230 Storage unit 131 Communication data storage unit 132 Monitoring item data storage unit 200 Vulnerability management device 221 Collection unit 222 Vulnerability determination unit 223 Notification unit 300 Monitored device 400 Communication device

Claims

1. A detection device comprising: an acquisition unit that acquires communication data of a device to be monitored; and an anomalous communication determination unit that uses the communication data acquired by the acquisition unit to determine whether communication is anomalous based on the difference between the communication status before a vulnerability in the device to be monitored was discovered and the communication status after the vulnerability was discovered.

2. The detection device described in claim 1, characterized in that the anomalous communication determination unit determines whether the similarity between the communication data before the vulnerability was discovered and the communication data after the vulnerability was discovered, output by a machine learning model that has been trained on the communication data before the vulnerability was discovered, is below a predetermined threshold.

3. The detection device described in claim 1, characterized in that the anomalous communication determination unit determines whether the difference between the numerical value of a specified monitoring item based on the communication data before the vulnerability was discovered and the numerical value of the communication data after the vulnerability was discovered is greater than or equal to a predetermined threshold.

4. A detection method executed by a detection device, comprising: an acquisition step of acquiring communication data of a device to be monitored; and an anomalous communication determination step of using the communication data acquired by the acquisition step to determine whether communication is anomalous based on the difference between the communication status before a vulnerability in the device to be monitored was discovered and the communication status after the vulnerability was discovered.

Images