System call analysis system, system call analysis device, and program

Abstract

A computer (5) of a system call analysis system (1000) is provided with: a system call extraction unit (520) that extracts a system call issued by an application (300), in the kernel (500) of the computer (5); and a system call transfer unit (530) that transfers information about the extracted system call to a system call analysis device (1). The system call analysis device (1) is provided with: a system call collection unit (110) that collects system call information from the computer (5); and a system call analysis unit (130) that analyzes statistical information obtained from a plurality of collected system calls and detects abnormalities in the application (300).

Description

System call analysis system, system call analysis device, and program

[0001] The present invention relates to a system call analysis system, a system call analysis device, and a program that collect and analyze system calls of application software in operation.

[0002] Conventionally, to detect application behavior, application logs (logs that record information about the application's execution conditions and status) and kernel logs (logs that record information about system calls made by processes related to the application's processing) are used to extract system calls related to processes linked to the application and determine whether the application is malicious or not.

[0003] On the other hand, in 5G core networks, which are expected to become widespread in communication network systems in the near future, various functions realized by applications within the communication network system are defined as NFs (Network Functions), and by combining various NFs, it is possible to construct a communication network (virtual network) that provides a wide variety of communication services (see, for example, Non-Patent Document 1). In this 5G core network, containers, which are one type of virtualization technology, are introduced and applications are implemented in the containers, thereby realizing the functions of various NFs as VNFs (Virtualized NFs).

[0004] Yuta Tanaka and four others, "5G Core Network Technology Overview for Realizing 5G SA Method," NTT DOCOMO Technical Journal, Vol. 30 No. 4 p6-17 Jan. 2023

[0005] The applications (for example, whose functions are realized by VNFs) running on the communication network devices (computers) that make up this communication network system are diverse, and are created by dividing the functions of the communication network devices to execute small, specialized functions (services). In particular, the creation, installation, and updating of applications (VNFs) realized by containers, etc., are shared and created by various software manufacturers. In other words, they are created independently from other software manufacturers, and the contents of the created applications (VNFs) are basically not disclosed (black boxes). The behavior of applications (VNFs) in these communication network devices can only be confirmed while the system is in operation, and until now, it has been difficult to detect signs of abnormalities or failures in applications (VNFs) installed in communication network devices.

[0006] The present invention has been made in view of the above points, and an object of the present invention is to obtain information regarding abnormalities and failures in applications.

[0007] The system call analysis system of the present invention is a system call analysis system comprising one or more computers and a system call analysis device that analyzes the system calls of the computers, wherein the computers comprise a system call extraction unit that extracts system calls issued by applications installed on the computers using the computer's kernel, and a system call transfer unit that transfers information about the extracted system calls to the system call analysis device, and the system call analysis device comprises a system call collection unit that collects information about the system calls from the computers, and a system call analysis unit that analyzes statistical information obtained from the collected multiple system calls and detects abnormalities in the applications.

[0008] According to the present invention, it is possible to obtain information regarding abnormalities and failures in applications.

[0009] FIG. 1 is a diagram showing an overview of the overall configuration of a system call analysis system according to a first embodiment of the present invention. FIG. 2 is a diagram showing an overview of the overall configuration of a system call analysis system according to a second embodiment of the present invention. FIG. 3 is a diagram showing a configuration (collection variation 1) of a system call analysis system according to the first embodiment. FIG. 4 is a diagram showing a configuration of a system call collection unit and the like of a system call analysis device in the configuration (collection variation 1) of a system call analysis system according to the first embodiment. FIG. 5 is a diagram showing an example data configuration of collected data stored in a data storage unit of a system call analysis device according to the embodiment. FIG. 6 is a diagram showing a configuration (collection variation 2) of a system call analysis system according to the first embodiment. FIG. 7 is a diagram showing a detailed configuration of a system call forwarding unit and the like provided in the container layer of a communication network device. FIG. 8 is a diagram showing a configuration (collection variation 3) of a system call analysis system according to the first embodiment. FIG. 9 is a diagram showing a detailed configuration of a system call extraction unit and the like in the kernel of a communication network device. FIG. 10 is a diagram showing a modified example of the detailed configuration of a system call extraction unit and the like in the kernel of a communication network device. FIG. 11 is a diagram showing a configuration (collection variation 4) of a system call analysis system according to the first embodiment. FIG. 12 is a diagram showing a detailed configuration of a system call extraction unit and the like in the kernel of a communication network device. FIG. 13 is a diagram showing a modified example of the detailed configuration of a system call extraction unit and the like in the kernel of a communication network device. FIG. 14 is a diagram showing a configuration (collection variation 5-1) of a system call analysis system according to the first embodiment. FIG. 1 is a diagram showing a configuration (collection variation 5-2) of a system call analysis system according to a first embodiment. FIG. 2 is a diagram showing a configuration (collection variation 5-3) of a system call analysis system according to a first embodiment. FIG. 3 is a diagram showing an overall configuration of a system call analysis system according to a second embodiment of the present invention. FIG. 4 is a diagram showing a configuration (condition setting variation 1) of a system call analysis system according to a second embodiment. FIG. 5 is a diagram showing a configuration (condition setting variation 2) of a system call analysis system according to a second embodiment. FIG. 6 is a diagram showing a configuration (condition setting variation 3) of a system call analysis system according to a second embodiment. FIG. 7 is a diagram showing a configuration (condition setting variation 4) of a system call analysis system according to a second embodiment.1 is a diagram illustrating the configuration of a system call analysis system according to a second embodiment (condition setting variation 5-1). FIG. 2 is a diagram illustrating the configuration of a system call analysis system according to a second embodiment (collection variation 5-2). FIG. 3 is a diagram illustrating the configuration of a system call analysis system according to a second embodiment (collection variation 5-3). FIG. 4 is a diagram illustrating the overall configuration of a system call analysis system that performs analysis to detect malware-infected software. FIG. 5 is a diagram illustrating the detailed configuration of a system call aggregation unit and other components included in the system call analysis device of the system call analysis system according to the present embodiment. FIG. 6 is a diagram illustrating an example of aggregation results for a certain VNF over a certain period of time under predetermined aggregation conditions, performed by the system call aggregation unit according to the present embodiment. FIG. 7 is a diagram illustrating an example of aggregation results for a certain VNF over a certain period of time, performed by the system call aggregation unit according to the present embodiment, related to two specific types of system calls. FIG. 8 is a diagram illustrating the detailed configuration of a system call analysis unit and other components included in the system call analysis device of the system call analysis system according to the present embodiment. FIG. 9 is a diagram illustrating how the system call analysis unit according to the present embodiment compares statistical information for system call collection periods y1 and y2 for a certain VNF to detect whether there is a change. 1 is a diagram illustrating an example of a system call analysis unit according to an embodiment of the present invention, which compares statistical information for a certain VNF during a period y1 and a period y2 of system call collection to detect whether or not there is a change. 2 is a diagram illustrating an example of a hardware configuration of a computer (communication network device) of a system call analysis system according to an embodiment of the present invention, and a computer that realizes the functions of the system call analysis device.

[0010] Next, an embodiment of the present invention (hereinafter referred to as "this embodiment") will be described. First, an overview of a system call analysis system 1000 according to this embodiment will be described.

[0011] 1 is a diagram showing an overview of the overall configuration of a system call analysis system 1000 (1000A) according to a first embodiment of the present invention. The system call analysis system 1000A is configured to include one or more computers 5 (for example, communication network devices shown in FIG. 3 and subsequent figures) and a system call analysis device 1 that is communicatively connected to the computer 5 (communication network device).

[0012] As shown in FIG. 1, the computer 5 is composed of a hardware layer 51 including a CPU, a storage device, etc., an OS layer 52 in which basic software such as an OS (Operating System) is stored, and an application layer 53 in which applications (referred to as "apps" in each drawing) for realizing each service are implemented.

[0013] The OS layer 52 includes a kernel 500, which is software that performs the basic functions of the OS. The kernel 500 permits execution of the application 300 and manages the process based on a system call from the application 300, etc. The application layer 53 includes one or more applications 300. Various services are executed by these applications 300. The application 300 outputs processing for executing the service to the kernel 500 by a system call, and performs processing using hardware resources such as a CPU and memory.

[0014] 1 , the system call analysis system 1000A according to the first embodiment includes a system call extraction unit 520 in a kernel 500 and a system call transfer unit 530 in an application layer 53 in a computer 5 (communication network device). The system call extraction unit 520 extracts (copies) system calls issued by applications 300 installed in the computer 5 (communication network device) in the kernel of the computer 5. The system call transfer unit 530 transfers information about the system calls extracted by the system call extraction unit 520 to the system call analysis device 1.

[0015] The system call analysis device 1 includes a system call collection unit 110 and a system call analysis unit 130. The system call collection unit 110 collects system call information from each computer 5. The system call analysis unit 130 analyzes statistical information obtained from the collected multiple system calls based on predetermined analysis conditions (analysis logic), extracts characteristics related to the behavior of the application 300, and detects abnormalities.

[0016] As a result, the system call analysis device 1 of the system call analysis system 1000A statistically analyzes system calls to identify signs of abnormalities or failures in the application.

[0017] 2 is a diagram showing an outline of the overall configuration of a system call analysis system 1000 (1000B) according to a second embodiment of the present invention. In addition to the functions of the system call analysis system 1000A shown in FIG. 1, the system call analysis system 1000 (1000B) according to the second embodiment includes a condition setting unit 150 in the system call analysis device 1 and a condition setting processing unit 550 in the application layer 53 of the computer 5. Note that in the system call analysis system 1000B in FIG. 2, functions that are the same as those in the system call analysis system 1000A shown in FIG. 1 are assigned the same numbers and descriptions thereof will be omitted.

[0018] The condition setting unit 150 of the system call analysis device 1 sets conditions to grasp in more detail signs of abnormalities or failures in the application 300, triggered by the analysis results of the system call analysis unit 130 or, for example, changes in the communication status of the computer 5. More specifically, the condition setting unit 150 sets conditions (predetermined collection conditions) for separating and selecting desired system calls from all system calls, and sets predetermined analysis conditions for extracting characteristics related to the behavior of the application 300. The condition setting unit 150 also sets the predetermined collection conditions in the computer 5 by sending information on the predetermined collection conditions (collection condition setting information) to the computer 5.

[0019] The condition setting processing unit 550 of the computer 5 receives the collection condition setting information from the system call analysis device 1 and sets the collection conditions in the system call extraction unit 520 and the system call transfer unit 530 of the kernel 500 .

[0020] As a result, the system call analysis device 1 of the system call analysis system 1000B can grasp symptoms of abnormalities, failures, and the like in more detail by changing the setting conditions for collecting and analyzing system calls.

[0021] The system call analysis device 1000 according to this embodiment will be described in detail below. In the embodiment described below, the computer 5 will be described as a communication network device 5 that constitutes a communication network system. The application 300 will be described as a VNF 300 accommodated in a container, which is a virtualization technology implemented in a 5G core network.

[0022] First Embodiment First, a specific example of a system call analysis system 1000A according to a first embodiment will be described. Note that in the first embodiment, there are multiple variations as to where each functional unit for collecting system calls is located in the communication network device 5 (5A) and the system call analysis device 1 (1A). These variations will be specifically described below.

[0023] [Collection Variation 1] FIG. 3 shows the system call analysis system 1000 (1000A) according to the first embodiment. １ 1 is a diagram showing the configuration (collection variation 1) of a system call analysis system 1000A (1000A １ ) is a communication network device 5 (5A １ ), and a system call analysis device 1 (1A １ ) and the communication network device 5 (5A １ ) is a specific example of the computer 5 shown in FIG. 1, and although not shown, it is connected to one or more communication network devices 5 (5A １ ) is the system call analysis device 1 (1A １ ) (the same applies to the following figures).

[0024] Communication network device 5 (5A １ ) is composed of a virtualization platform 54 realized by virtualization technology in the 5G core network and VNFs 300 (VNFs #1, #2, #3, ...) constructed in a container layer 55 on the virtualization platform 54. The virtualization platform 54 is a virtualized version of middleware, an OS, and hardware, and includes a kernel 500.

[0025] The system call analysis system 1000 (1000A) shown in FIG. １ ) (Collection Variation 1) is characterized in that the system call analysis device 1 (system call collection unit 110) is provided with a selection unit 10 that selects system calls to be collected from among the system calls received by the kernel 500 from the VNF 300, and a storage unit 20 that stores the selected system calls (Collection Variation 1).

[0026] In addition, the communication network device 5 (5A １ The kernel 500 of the container layer 55 includes a system call extraction unit 520. The system call extraction unit 520 includes a duplication unit 521 and an output unit 522. The duplication unit 521 duplicates the system calls received by the kernel 500 from each VNF 300. The output unit 522 outputs the system calls duplicated by the duplication unit 521 to a system call transfer unit 530 in the container layer 55.

[0027] Communication network device 5 (5A １ The container layer of the system call analysis device 1 (1A) includes a system call transfer unit 530. The system call transfer unit 530 includes a transfer processing unit 531. The transfer processing unit 531 transfers the system calls copied by the system call extraction unit 520 to the system call analysis device 1 (1A). １ Here, the transfer processing unit 531 transfers all of the system calls copied by the copying unit 521 of the system call extraction unit 520 to the system call analysis device 1 (1A １ ) to forward the call.

[0028] System call analysis device 1 (1A １) includes a system call collection unit 110, a system call tallying unit 120, a system call analysis unit 130, and a data storage unit 140. The system call collection unit 110 collects system call information from each computer 5 and stores it in the data storage unit 140 as collected data 400.

[0029] The system call tallying unit 120 tally the collected system calls in accordance with predetermined tallying conditions such as the occurrence time, type, and number of occurrences of the system calls. The system call tallying unit 120 then stores the tallying results as tally data 450 in the data storage unit 140. Details of the system call tallying unit 120 will be described later with reference to FIGS. 26 to 28.

[0030] The system call analysis unit 130 uses the aggregated data 450 aggregated by the system call aggregation unit 120 based on a predetermined analysis logic (analysis conditions) to detect, for example, changes from normal times, thereby detecting signs of abnormalities or failures in the VNF 300. The system call analysis unit 130 then transmits the analysis results to a system management device or the like of the system call analysis system 1000. Details of the system call analysis unit 130 will be described later with reference to FIGS. 29 to 31.

[0031] The data storage unit 140 stores the information on the system calls collected by the system call collection unit 110 as collected data 400. The data storage unit 140 also stores aggregated data 450 that the system call aggregation unit 120 aggregates in accordance with predetermined rules (aggregation conditions).

[0032] FIG. 4 shows a system call analysis system 1000 (1000A) according to the first embodiment. １ ) in the configuration (variation 1) of the system call analysis device 1 (1A １ 4 is a diagram showing the configuration of a system call collection unit 110 and the like of the system call analysis device 1 (1A). As shown in FIG. 4, the system call collection unit 110 of the system call analysis device 1 (1A) includes a selection unit 10, a storage unit 20, and an output processing unit 111.

[0033] Predetermined collection conditions for collecting system calls are set in the selection unit 10. Based on these collection conditions, the selection unit 10 performs selection, such as sorting system calls by type and selecting and discarding them. For example, the following multiple collection conditions are set in the selection unit 10, such as collection conditions 1, 2, and 3 (see FIG. 4). Collection condition 1: Whether or not to collect is determined for each communication network device 5 to be collected. In other words, only system calls from the communication network device 5 specified as the collection condition are collected, and system calls from other communication network devices 5 are not collected. Collection condition 2: The type of VNF to be collected is specified. In other words, whether or not to collect system calls is determined for each communication network device 5 and for each type of VNF 300 specified. Collection condition 3: The type of system call to be collected is specified. In other words, whether or not to collect is determined depending on the type of system call to be collected.

[0034] The accumulation unit 20 accumulates (stores) the system calls that have been selected by the selection unit 10 based on predetermined collection conditions. The accumulation unit 20 accumulates (stores) the system calls based on the predetermined accumulation conditions that have been set. The predetermined accumulation conditions include, for example, the time of collection, the collection period (time interval), and the collection capacity. When the predetermined accumulation conditions are met, the accumulation unit 20 outputs the system calls to the output processing unit 111.

[0035] The output processing unit 111 outputs the system call output from the accumulation unit 20 to the data saving unit 140 , and saves it as collected data 400 .

[0036] FIG. 5 is a diagram illustrating an example of the data configuration of collected data 400 stored in the data storage unit 140 of the system call analysis device 1 according to this embodiment. The collected data 400 stores system calls for each collection condition selected by the selection unit 10. In FIG. 5 , for each communication network device 5 (#1, #2, ..., #n) (collection condition 1) and for each VNF 300 (#1, #2, ..., #n) (collection condition 2), specified system calls (denoted as "SC" in each figure) (collection condition 3) are stored in chronological order along with the time of collection. The types of system calls (SC1, SC2, ..., SCx, SCy, SCz) are designated functions (APIs) such as open, read, write, close, wait, fork, and kill.

[0037] Returning to FIG. 4, the system call tallying unit 120 tally the collected system calls using the collected data 400 stored in the data storage unit 140 (details will be described later).

[0038] [Collection Variation 2] FIG. 6 shows the system call analysis system 1000 (1000A) according to the first embodiment. ２ ) (Collection Variation 2) is shown in FIG.

[0039] The system call analysis system 1000 (1000A) shown in FIG. ２ ) (Collection Variation 2) is a system in which a selection unit 10 that selects system calls to be collected from among system calls received by the kernel 500 from the VNF 300 and a storage unit 20 that stores the selected system calls are provided in a communication network device 5 (5A ２ 6, the system call transfer unit 530 includes a filtering unit 20 and a storage unit 30.

[0040] System call analysis system 1000 (1000A ２In the above-mentioned system call extracting unit 520, a system call extracting unit 520 in a kernel 500 includes a duplicating unit 521 and an output unit 522. The duplicating unit 521 duplicates a system call received by the kernel 500 from each VNF 300, and the output unit 522 outputs the system call to a system call forwarding unit 530 in a container layer 55.

[0041] FIG. 7 shows the communication network device 5A. ２ 7 is a diagram showing a detailed configuration of a system call transfer unit 530 and the like provided in the container layer 55 of the communication network device 5A. ２ The system call transfer unit 530 includes a selection unit 10 , a storage unit 20 , and a transfer processing unit 531 .

[0042] The following collection conditions, for example, are set in this selection unit 10 as predetermined collection conditions for collecting system calls: Collection condition 1: Specifies the type of VNF 300 to be collected. In other words, it is determined whether or not to collect system calls for each type of VNF 300 specified. Collection condition 2: Specifies the type of system calls to be collected. In other words, it is determined whether or not to collect system calls depending on the type of system calls to be collected.

[0043] The accumulation unit 20 accumulates (stores) system calls that have been selected by the selection unit 10 based on predetermined collection conditions. The accumulation unit 20 accumulates (stores) system calls based on the predetermined accumulation conditions that are set. The predetermined accumulation conditions include, for example, the time of collection, the collection period (time interval), and the collection capacity. When the predetermined accumulation conditions are met, the accumulation unit 20 outputs the system call to the transfer processing unit 531.

[0044] The transfer processing unit 531 transfers the system calls (accumulated data) accumulated by the accumulation unit 20 to the system call analysis device 1 (1A ２ At this time, the transfer processing unit 531 adds the identification information of the communication network device 5 to which it belongs and transmits the system call (accumulated data). ２The system call collection unit 110 of the system call collection device 110 stores the received system calls (accumulated data) in the data storage unit 140 as collected data 400 .

[0045] [Collection Variation 3] FIG. 8 shows the system call analysis system 1000 (1000A) according to the first embodiment. ３ ) (Collection Variation 3) is shown in FIG.

[0046] The system call analysis system 1000 (1000A) shown in FIG. ３ ) (Collection Variation 3) is a configuration in which a selection unit 10 that selects system calls to be collected from among the system calls received by the kernel 500 from the VNF 300 is provided in the communication network device 5 (5A ３ ) in the kernel 500, and a storage unit 20 for storing selected system calls is provided in the system call transfer unit 530 of the container layer 55.

[0047] FIG. 9 shows the communication network device 5A. ３ 9 is a diagram showing a detailed configuration of a system call extraction unit 520 and the like in the kernel 500 of the communication network device 5A. ３ The system call extraction unit 520 includes a duplication unit 521, a selection unit 10, and an output unit 522. The duplication unit 521 duplicates all system calls sent from the VNF 300 to the kernel 500. The duplication unit 521 then outputs the duplicated system calls to the selection unit 10.

[0048] The selection unit 10 is set with the following collection conditions as predetermined collection conditions for collecting system calls: Collection condition 1: Specifies the type of VNF 300 to be collected. In other words, it determines whether or not to collect system calls for each type of VNF 300 specified. Collection condition 2: Specifies the type of system calls to be collected. In other words, it determines whether or not to collect them depending on the type of system calls to be collected. The selection unit 10 then selects only system calls that match these collection conditions.

[0049] The output unit 522 outputs the system calls that match the collection conditions 1 and 2 in the selection unit 10 to the system call transfer unit 530 of the container layer 55. The system calls are then accumulated (stored) in the storage unit 20 in the system call transfer unit 530, and when a predetermined storage condition is reached, the transfer processing unit 531 transfers the system calls to the system call analysis device 1 (1A ３ ) to forward the call.

[0050] <Modification of Fig. 9> A modification of the system call extraction unit 520 shown in Fig. 9 will be described. In Fig. 9, the duplication unit 521 duplicates all system calls. Alternatively, as shown in Fig. 10, only the system calls to be collected may be duplicated.

[0051] FIG. 10 shows the communication network device 5A. ３ 10 is a diagram illustrating a modified example of the detailed configuration of the system call extraction unit 520 in the kernel 500. In FIG. 10, the system call extraction unit 520 first captures all system calls sent from the VNF 300 to the kernel 500. Then, the selection unit 10 selects the system calls based on predetermined collection conditions. The predetermined collection conditions are, for example, the same as the collection conditions (collection conditions 1 and 2) described in FIG. 7. Note that system calls that have not been selected proceed to processing in the kernel 500 as usual. Then, the duplication unit 521 duplicates the system calls that have been selected by the selection unit 10 based on the predetermined collection conditions. In other words, it duplicates only the system calls to be collected. Note that the system calls that were the source of the duplication proceed to processing in the kernel 500 as usual.

[0052] The output unit 522 outputs the system call copied by the copying unit 521 to the system call transfer unit 530 of the container layer 55. The system call is stored in the storage unit 20 in the system call transfer unit 530, and when a predetermined storage condition is reached, the transfer processing unit 531 transfers the system call to the system call analysis device 1 (1A ３ ) to forward the call.

[0053] [Collection Variation 4] FIG. 11 shows the system call analysis system 1000 (1000A) according to the first embodiment. ４ ) (Collection Variation 4) is shown in FIG.

[0054] The system call analysis system 1000 (1000A) shown in FIG. ４ ) (Collection Variation 4) is a configuration in which a selection unit 10 that selects system calls to be collected from among system calls received by the kernel 500 from the VNF 300 and a storage unit 20 are provided in a communication network device 5 (5A ４ ) is characterized by being provided in a system call extraction unit 520 in a kernel 500.

[0055] FIG. 12 shows the communication network device 5A. ４ 12 is a diagram showing a detailed configuration of a system call extraction unit 520 and the like in the kernel 500 of the communication network device 5A. ４ The system call extraction unit 520 includes a duplication unit 521, a selection unit 10, a storage unit 20, and an output unit 522. The duplication unit 521 duplicates all system calls sent from the VNF 300 to the kernel 500. The duplication unit 521 then outputs the duplicated system calls to the selection unit 10.

[0056] In this selection unit 10, collection conditions 1, 2, etc. are set as predetermined collection conditions for collecting system calls, similar to those described with reference to Fig. 9. Then, the selection unit 10 selects only system calls that match these collection conditions.

[0057] The accumulation unit 20 accumulates (stores) the system calls that match the collection conditions 1 and 2 in the selection unit 10 based on the predetermined accumulation conditions that are set. When the predetermined accumulation conditions are met, the accumulation unit 20 outputs the system calls to the output unit 522. The output unit 522 outputs the system calls accumulated in the accumulation unit 20 to the system call transfer unit 530 of the container layer 55. Then, the system call transfer unit 530 outputs the acquired system calls to the system call analysis device 1 (1A ４ ) to forward the call.

[0058] <Modification of Fig. 12> A modification of the system call extraction unit 520 shown in Fig. 12 will be described. In Fig. 12, the duplication unit 521 duplicates all system calls. Alternatively, only the system calls to be collected may be duplicated.

[0059] FIG. 13 shows the communication network device 5A. ４ 13 is a diagram showing a modified example of the detailed configuration of the system call extraction unit 520 and the like in the kernel 500. In FIG. 13, first, the system call extraction unit 520 captures all system calls issued from the VNF 300 to the kernel 500. Then, the selection unit 10 selects the system calls based on predetermined collection conditions. The predetermined collection conditions are, for example, the same as the collection conditions 1 and 2 described in FIG. 9. Then, the duplication unit 521 duplicates the system calls selected by the selection unit 10 based on the predetermined collection conditions. In other words, only the system calls to be collected are duplicated.

[0060] The accumulation unit 20 accumulates (stores) the system calls that are replicated by the replication unit 521 for the system calls that are selected by the selection unit 10 under predetermined collection conditions. When the accumulation unit 20 reaches a predetermined accumulation condition, it outputs the system calls to the output unit 522. The output unit 522 outputs the system calls that are output by the accumulation unit 20 to the system call transfer unit 530 of the container layer 55. The system call transfer unit 530 then transfers the system call information to the system call analysis device 1 (1A ４ ) to forward the call.

[0061] [Collection Variation 5] Next, collection variation 5 will be described. When providing the kernel 500 of the communication network device 5 with a function for collecting (extracting) system calls, there are two methods: modifying the kernel 500 and using eBPF (Extended Berkeley Packet Filter). eBPF is a kernel technology that allows programs to be executed without modifying the kernel source code or adding modules (introduced in Linux 4.x: "Linux" is a registered trademark). By using eBPF, it is possible to provide a function for extracting (duplicating) system calls without modifying the kernel source code. In collection variation 5, an eBPF function and condition setting unit 540 is provided in the container layer 55 of the communication network device 5.

[0062] FIG. 14 shows a system call analysis system 1000 (1000A) according to the first embodiment. ５ 14 is a diagram showing the configuration (collection variation 5-1) of the communication network device 5 (5A). In the collection variation 5-1, as shown in FIG. 14, the filtering unit 10 and the storage unit 20 are provided in the communication network device 5 (5A), as in the case of FIGS. ５ ) is provided in the system call transfer unit 530 of the container layer 55.

[0063] The eBPF function and condition setting unit 540 uses the eBPF function to set the functions of the system call extraction unit 520 (duplication unit 521, output unit 522) in the kernel 500. The eBPF function and condition setting unit 540 also sets the collection conditions of the selection unit 10 and the storage conditions of the storage unit 20, which are provided in the system call transfer unit 530. Furthermore, the eBPF function and condition setting unit 540 sets the transfer processing unit 531 to (immediately) transfer the acquired system call information to the system call analysis device 1.

[0064] FIG. 15 shows a system call analysis system 1000 (1000A) according to the first embodiment. ５15 is a diagram showing the configuration (collection variation 5-2) of the system call extractor 520 in the kernel 500, similar to the configurations shown in FIGS. 8 and 9. In collection variation 5-2, as shown in FIG. 15, the filter 10 is provided in the system call extractor 520 in the kernel 500, and the storage unit 20 is provided in the system call transfer unit 530 in the container layer 55.

[0065] The eBPF function and condition setting unit 540 uses the eBPF function to set the functions of the system call extraction unit 520 (the duplication unit 521, the selection unit 10, and the output unit 522) in the kernel 500. The eBPF function and condition setting unit 540 also sets the collection conditions (collection conditions 1 and 2) for the selection unit 10 provided in the system call extraction unit 520. The eBPF function and condition setting unit 540 also sets the storage conditions for the storage unit 20 in the system call transfer unit 530, and sets the transfer processing unit 531 to (immediately) transfer the acquired system call information to the system call analysis device 1.

[0066] 10 , the eBPF function / condition setting unit 540 first has the system call extraction unit 520 capture all system calls sent from the VNF 300 to the kernel 500, and the selection unit 10 selects the system calls based on predetermined collection conditions. Then, the duplication unit 521 duplicates the system calls selected by the selection unit 10 based on the predetermined collection conditions. In other words, it is also possible to duplicate only the system calls to be collected.

[0067] FIG. 16 shows a system call analysis system 1000 (1000A) according to the first embodiment. ５ 16 is a diagram showing the configuration (collection variation 5-3) of the system call extraction unit 520 in the kernel 500. In collection variation 5-3, as shown in FIG. 16, the selection unit 10 and the accumulation unit 20 are provided in the system call extraction unit 520 in the kernel 500, similar to the configurations shown in FIGS. 11 and 12.

[0068] The eBPF function and condition setting unit 540 uses the eBPF function to set the functions of the system call extraction unit 520 (the duplication unit 521, the selection unit 10, the accumulation unit 20, and the output unit 522) in the kernel 500. The eBPF function and condition setting unit 540 also sets the transfer processing unit 531 in the system call transfer unit 530 to transfer the acquired system call information (immediately) to the system call analysis device 1.

[0069] 13, the eBPF function and condition setting unit 540 first has the system call extraction unit 520 capture all system calls sent from the VNF 300 to the kernel 500, and the selection unit 10 selects the system calls based on predetermined collection conditions. Then, the duplication unit 521 duplicates the system calls selected by the selection unit 10 based on the predetermined collection conditions. In other words, it is also possible to duplicate only the system calls to be collected.

[0070] The above has described system call collection variations 1 to 5. Which of these collection variations is to be adopted is determined in advance by the system administrator or the like.

[0071] Second Embodiment Next, a specific example of a system call analysis system 1000B according to a second embodiment will be described. As shown in FIG. 17 , the system call analysis system 1000B is characterized in that a condition setting unit 150 is provided in the system call analysis device 1 (1B). The condition setting unit 150 acquires information on setting conditions (setting condition information) related to the collection, aggregation, and analysis of system calls from the communication network system management device 8. The condition setting unit 150 then sets the conditions indicated by the setting condition information for the system call collection unit 110, the system call aggregation unit 120, and the system call analysis unit 130. The condition setting unit 150 also acquires conditions related to the collection of system calls from the setting condition information as collection condition setting information, and sets the collection conditions for the selection unit 10 and the accumulation conditions for the accumulation unit 30. When the selection unit 10 and the accumulation unit 30 are configured in the communication network device 5 (5B), a condition setting processing unit 550 is provided in the container layer 55 of the communication network device 5 (5B). The system call analysis system 1000B changes the setting conditions (collection conditions, aggregation conditions, analysis conditions) in response to changes in the system call analysis results, communication status, etc. This allows the system call analysis system 1000B to grasp symptoms of abnormalities and failures in more detail.

[0072] A specific example of the system analysis system 1000B according to the second embodiment will be described below. In the second embodiment, there are several variations in the method of setting conditions depending on where in the communication network device 5 (5B) and the system call analysis device 1 (1B) each functional unit for collecting system calls is located. These variations will be described in detail below.

[0073] [Variation 1 of Condition Setting] FIG. 18 is a diagram showing the configuration (variation 1 of condition setting) of the system call analysis system 1000 (1000B) according to the second embodiment. １ The system call analysis device 1 (1B) includes a selection unit 10 and a storage unit 20 in a system call collection unit 110. １) is characterized by including a condition setting unit 150.

[0074] The condition setting unit 150 acquires information on setting conditions (setting condition information) related to the collection, aggregation, and analysis of system calls from the communication network system management device 8. Then, the condition setting unit 150 acquires conditions related to the collection of system calls from the setting condition information as collection condition setting information, and sets the collection conditions of the selection unit 10 and the storage conditions of the storage unit 30, etc.

[0075] The selection unit 10 sets and changes, for example, the above-mentioned collection condition 1 (communication network device to be collected), collection condition 2 (type of VNF), and collection condition 3 (type of system call) based on the collection condition setting information obtained from the condition setting unit 150.

[0076] The accumulation unit 20 sets and changes predetermined accumulation conditions (collection time, collection duration, collection capacity) and the like based on the collection condition setting information acquired from the condition setting unit 150 .

[0077] The output processing unit 111 is set to output the acquired system call information (immediately) to the data storage unit 140 and store it in the data storage unit 140 as collected data 400 .

[0078] [Variation 2 of Condition Setting] FIG. 19 is a diagram showing the configuration (variation 2 of condition setting) of the system call analysis system 1000 (1000B) according to the second embodiment. The system call analysis system 1000 (1000B) shown in FIG. ２ ) (variation 2 of condition setting) communication network device 5B ２ The container layer 55 includes a system call transfer unit 530 and a condition setting processing unit 550. The condition setting processing unit 550 is a ２ The collection condition setting unit 520 obtains collection condition setting information from the condition setting unit 150 of the system call extraction unit 520, and sets and changes conditions for the system call extraction unit 520 and the system call transfer unit 530.

[0079] More specifically, the selection unit 10 sets and changes, for example, the above-mentioned collection condition 1 (type of VNF) and collection condition 2 (type of system call) based on the collection condition setting information acquired from the condition setting unit 150.

[0080] Furthermore, the accumulation unit 20 sets and changes predetermined accumulation conditions (collection time, collection duration, collection capacity) and the like based on the collection condition setting information acquired from the condition setting unit 150 .

[0081] The transfer processing unit 531 is set to transfer the acquired system call information (immediately) to the system call analysis device 1 B. The condition setting processing unit 550 also sets the system call extraction unit 520 so that the duplicating unit 521 duplicates all system calls and the output unit 522 (immediately) outputs the duplicated system calls to the system call transfer unit 530.

[0082] [Condition Setting Variation 3] FIG. 20 shows the system call analysis system 1000 (1000B) according to the second embodiment. ３ 20 is a diagram showing the configuration (variation 3 of condition setting) of the system call analysis system 1000 (1000B) shown in FIG. ３ ) (variation 3 of condition setting) communication network device 5B ３ includes a system call transfer unit 530 and a condition setting processing unit 550 in a container layer 55. The system call extraction unit 520 of the kernel 500 includes a duplication unit 521, a selection unit 10, and an output unit 522, and the system call transfer unit 530 includes a storage unit 20.

[0083] The condition setting processing unit 550 acquires collection condition setting information from the condition setting unit 150 of the system call analysis device 1 (1B), and sets and changes conditions for the system call extraction unit 520 (selection unit 10) and the system call transfer unit 530 (storage unit 20), etc.

[0084] As a modified example of the system call extraction unit 520 shown in FIG. 20, the selection unit 10 may select system calls based on predetermined collection conditions, and then the duplication unit 521 may duplicate only the system calls collected, as shown in FIG. 10.

[0085] [Condition Setting Variation 4] FIG. 21 shows the system call analysis system 1000 (1000B) according to the second embodiment. ４ 21 is a diagram showing the configuration of the system call analysis system 1000 (1000B) shown in FIG. ４ ) (variation 4 of condition setting) communication network device 5B ４ includes a system call transfer unit 530 and a condition setting processing unit 550 in a container layer 55. The system call extraction unit 520 of the kernel 500 includes a duplication unit 521, a selection unit 10, a storage unit 20, and an output unit 522.

[0086] The condition setting processing unit 550 is a system call analysis device 1 (1B ４ ) and sets and changes conditions for the system call extraction unit 520 (selection unit 10 and accumulation unit 20) and the system call transfer unit 530, etc.

[0087] As a modified example of the system call extraction unit 520 shown in FIG. 21, as shown in FIG. 13, the selection unit 10 may select system calls based on predetermined collection conditions, and then the duplication unit 521 may duplicate only the system calls collected.

[0088] [Condition Setting Variation 5] Next, condition setting variation 5 will be described. In condition setting variation 5, an eBPF function and condition setting unit 540B is provided in the container layer 55 of the communication network device 5B. The eBPF function and condition setting unit 540B uses the eBPF function to set the functions of the system call extraction unit 520. Furthermore, the eBPF function and condition setting unit 540B sets and changes the collection conditions of the selection unit 10 and the storage conditions of the storage unit 20, etc., based on the collection condition setting information received from the condition setting unit 150 of the system call analysis device 1B.

[0089] FIG. 22 shows a system call analysis system 1000 (1000B) according to the second embodiment. ５ 22 is a diagram showing the configuration (variation 5-1 of condition setting) of the communication network device 5 (5B) in the same manner as in FIG. 14. In the variation 5-1 of condition setting, as shown in FIG. ５ ) is provided in the system call transfer unit 530 of the container layer 55.

[0090] The eBPF function and condition setting unit 540B uses the eBPF function to set the functions of the system call extraction unit 520 (the replication unit 521 and the output unit 522) in the kernel 500. The eBPF function and condition setting unit 540B also sets the functions of the system call analysis device 1B. ５ Based on the collection condition setting information received from the condition setting unit 150, the eBPF function and condition setting unit 540B sets the collection conditions of the selection unit 10 and the storage conditions of the storage unit 20, which are provided in the system call transfer unit 530. Furthermore, the eBPF function and condition setting unit 540B sets the transfer processing unit 531 to (immediately) transfer the acquired system call information to the system call analysis device 1.

[0091] FIG. 23 shows a system call analysis system 1000 (1000B) according to the second embodiment. ５23 is a diagram showing a configuration (collection variation 5-2) of the condition setting variation 5-2. As shown in FIG. 23, in the same way as in FIG. 15 described above, the filtering unit 10 is provided in the system call extraction unit 520 in the kernel 500, and the accumulation unit 20 is provided in the system call transfer unit 530 in the container layer 55.

[0092] The eBPF function and condition setting unit 540B uses the eBPF function to set the functions of the system call extraction unit 520 (the replication unit 521, the selection unit 10, and the output unit 522) in the kernel 500. The eBPF function and condition setting unit 540B also sets the functions of the system call analysis device 1B. ５ Based on the collection condition setting information received from the condition setting unit 150, the eBPF function and condition setting unit 540B sets and changes the collection conditions of the selection unit 10 provided in the system call extraction unit 520. Furthermore, based on the collection condition setting information, the eBPF function and condition setting unit 540B sets and changes the storage conditions of the storage unit 20, and sets the transfer processing unit 531 to (immediately) transfer the acquired system call information to the system call analysis device 1.

[0093] 10, in the eBPF function / condition setting unit 540B, first, the system call extraction unit 520 captures all system calls sent from the VNF 300 to the kernel 500, and the selection unit 10 selects the system calls based on predetermined collection conditions. Then, the duplication unit 521 duplicates the system calls selected by the selection unit 10 based on the predetermined collection conditions. In other words, it is also possible to duplicate only the system calls to be collected.

[0094] FIG. 24 shows a system call analysis system 1000 (1000B) according to the second embodiment. ５ 24 is a diagram showing a configuration (collection variation 5-3) of the condition setting variation 5-3. As shown in FIG. 24, in the same way as in FIG. 16 described above, the filtering unit 10 and the accumulation unit 20 are provided in the system call extraction unit 520 in the kernel 500.

[0095] The eBPF function and condition setting unit 540B uses the eBPF function to set the functions of the system call extraction unit 520 (the replication unit 521, the selection unit 10, the accumulation unit 20, and the output unit 522) in the kernel 500. The eBPF function and condition setting unit 540B also sets the functions of the system call analysis device 1B. ５ Based on the collection condition setting information received from the condition setting unit 150, the eBPF function and condition setting unit 540B sets and changes the collection conditions of the selection unit 10 and the storage conditions of the storage unit 20 provided in the system call extraction unit 520. Furthermore, the eBPF function and condition setting unit 540B sets the transfer processing unit 531 in the system call transfer unit 530 to (immediately) transfer the acquired system call information to the system call analysis device 1 based on the collection condition setting information.

[0096] 13, the eBPF function / condition setting unit 540B first has the system call extraction unit 520 capture all system calls sent from the VNF 300 to the kernel 500, and the selection unit 10 selects the system calls based on predetermined collection conditions. Then, the duplication unit 521 duplicates the system calls selected by the selection unit 10 based on the predetermined collection conditions. In other words, it is also possible to duplicate only the system calls to be collected.

[0097] <Setting Condition Information> Here, the setting condition information that the condition setting unit 150 of the system call analysis device 1 (1B) acquires from the communication network system management device 8, etc. will be described. In the system call analysis system 1000B according to the second embodiment, the condition setting unit 150 of the system call analysis device 1 (1B) acquires information on setting conditions related to the collection, aggregation, and analysis of system calls (setting condition information) from the communication network system management device 8, etc. The communication network system management device 8 creates this setting condition information using information acquired based on the acquisition method described below.

[0098] (1) Obtain information from the manufacturer of the VNF 300. By obtaining error information obtained by the manufacturer of the VNF 300 through testing during the manufacturing process, for example, system calls that have the characteristic of increasing or decreasing when an error occurs are extracted.

[0099] (2) Use the analysis results of the system call analysis system 1000. For example, if information on an abnormality, a failure, or a precursor to such an abnormality or failure is obtained from the analysis results of the system call analysis system 1000, change the collection conditions based on that information to obtain more detailed information.

[0100] (3) The system call analysis system 1000 is applied to malware-infected software, and the analysis results are utilized. FIG. 25 is a diagram showing the overall configuration of the system call analysis system 1000 (1000M) that performs analysis to detect malware-infected software. As shown in FIG. 25, a communication network device 5 (5B) that operates normally and a communication network device 5 (5B) that has been infected with malware are analyzed. Ｍ ) and collects system call information from each communication network device 5. Meanwhile, a system call analysis device 1 (1B Ｍ The system call analysis device 1 (1B) is provided with an abnormal state information storage unit 160 as a function for detecting malware infection and storing the information. Ｍ The system call analysis unit 130 of the software 300 compares the statistical information of the normal software 300 with the statistical information of the malware-infected software 300 to derive information characteristic of the malware infection. The information is then stored in the abnormal state information storage unit 160 and output to the communication network system management device 8, etc.

[0101] These acquisition methods allow the communication network system management device 8 to quickly identify signs of abnormalities or failures, and by changing the system call collection conditions, generate setting condition information that enables more detailed and reliable information to be acquired. Therefore, the system call analysis system 1000 according to this embodiment can accurately identify abnormalities or failures in the application (VNF) 300 by appropriately acquiring more appropriate setting condition information from the communication network system management device 8.

[0102] <System Call Counting Unit> Next, a detailed description will be given of the system call counting unit 120. The system call counting unit 120 counts system calls from the collected data 400 stored in the data storage unit 140 based on predetermined counting conditions such as the type of system call to be collected, the time and type of system call, and the number of occurrences.

[0103] FIG. 26 is a diagram showing a detailed configuration of the system call tallying unit 120 and other components included in the system call analysis device 1 of the system call analysis system 1000 according to this embodiment. As shown in FIG. 26 , the system call tallying unit 120 includes a tallying / distributing unit 121. The tallying / distributing unit 121 acquires, as tally condition setting information, conditions related to system call tallying from the setting condition information acquired by the condition setting unit 150, for example, from the communication network system management device 8. Based on this tally condition setting information, the tallying / distributing unit 121 identifies the types of system calls to be tallyed and sets tally conditions A, B, ..., N as predetermined tally conditions. The tallying / distributing unit 121 then stores tally data 450 tallying under each tally condition A, B, ..., N in the data storage unit 140.

[0104] 27 is a diagram illustrating the results of the system call counting unit 120 according to this embodiment counting a certain VNF 300 over a certain period of time under predetermined counting conditions. The graph indicated by reference numeral 211 in FIG. 27 shows statistics on the number of occurrences of each system call under counting condition A. The horizontal axis represents the type of system call, and the vertical axis represents the number of occurrences of the system call.

[0105] 27 shows statistics on the occurrence interval of a specific type (SCp) of system call as counting condition B. The horizontal axis represents the occurrence interval time, and the vertical axis represents the number of occurrences.

[0106] 27 shows statistics on the frequency with which a specific type of system call (SCp) occurs consecutively as counting condition C. The horizontal axis represents the number of consecutive occurrences, and the vertical axis represents the number of occurrences.

[0107] Although not shown in the figure, statistics on the size of a specific type (SCp) of system call may also be used as the counting condition D. In this case, the horizontal axis represents the data size, and the vertical axis represents the number of occurrences.

[0108] 28 is a diagram illustrating the results of the system call counting unit 120 according to this embodiment counting data for a certain period of time in relation to two specific types of system calls for one VNF 300. The graph indicated by reference numeral 214 in Fig. 28 shows statistics on the frequency with which two specific types of system calls (SCp, SCq) occur consecutively, as counting condition E. The horizontal axis represents the number of consecutive occurrences, and the vertical axis represents the number of occurrences.

[0109] 28 shows statistics of the intervals between occurrences of two specific types of system calls (SCp, SCq) as counting condition F. The horizontal axis represents the interval time between occurrences, and the vertical axis represents the number of occurrences.

[0110] The system call counting unit 120 stores the counting results under each counting condition as counted data 450 in the data storage unit 140 .

[0111] <System Call Analysis Unit> Next, a detailed description will be given of the system call analysis unit 130. The system call analysis unit 130 analyzes system calls based on predetermined analysis conditions, such as comparing statistical information from different periods during which system calls were collected, for the aggregated data 450 stored in the data storage unit 140.

[0112] FIG. 29 is a diagram showing the detailed configuration of the system call analysis unit 130 and other components included in the system call analysis device 1 of the system call analysis system 1000 according to this embodiment. As shown in FIG. 29 , the system call analysis unit 130 includes an analysis distribution unit 131 and an analysis result aggregation unit 132. The analysis distribution unit 131 acquires, as analysis condition setting information, conditions related to the analysis and aggregation of system calls from the setting condition information acquired by the condition setting unit 150, for example, from the communication network system management device 8. Based on this analysis condition setting information, the analysis distribution unit 131 identifies the type of system call to be analyzed and sets analysis conditions a, b, ..., n as predetermined analysis conditions. The analysis distribution unit 131 then analyzes the aggregation data 450 based on each analysis condition a, b, ..., n. The analysis result aggregation unit 132 aggregates the results of the analysis performed under each analysis condition a, b, ..., n (analysis results) and transmits them to the communication network management device 8 and other devices.

[0113] FIG. 30 is a diagram illustrating how the system call analysis unit 130 according to this embodiment compares statistical information for a certain VNF 300 between a system call collection period y1 and a system call collection period y2 to detect whether there is a change.

[0114] Analysis condition a is to detect whether there is a change by comparing the number of system calls made over different periods. The upper and lower graphs denoted by reference numeral 311 in Figure 30 are statistical information collected by the system call collection unit 120 under collection condition A (number of system calls made), with the upper graph showing period y1 and the lower graph showing period y2. Here, it is analyzed that there is no change in the number of system calls made of each type between period y1 and period y2.

[0115] Analysis condition b is to detect whether there is a change by comparing the number of occurrences of system calls at each occurrence interval over different time periods. The upper and lower graphs denoted by reference numeral 312 in Figure 30 are statistical information collected by the system call collection unit 120 under collection condition B (system call occurrence interval), with the upper graph showing period y1 and the lower graph showing period y2. Here, it is analyzed that there is no change in the number of occurrences of system calls (SCp) at each occurrence interval between periods y1 and y2.

[0116] Analysis condition c is to detect whether there is a change by comparing the frequency of consecutive system calls over different time periods. The upper and lower graphs denoted by reference numeral 313 in Figure 30 are statistical information collected by the system call collection unit 120 under collection condition C (frequency of consecutive system calls), with the upper graph representing period y1 and the lower graph representing period y2. Here, it is shown that there is a change in the number of occurrences between period y1 and period y2 when the consecutive number is "5."

[0117] FIG. 31 is a diagram illustrating how the system call analysis unit 130 according to this embodiment compares statistical information for a certain VNF 300 between a system call collection period y1 and a system call collection period y2 to detect whether there is a change.

[0118] Analysis condition d is to detect whether there is a change by comparing the frequency with which two specific types of system calls (SCp, SCq) occur consecutively over different time periods. The upper and lower graphs denoted by reference numeral 314 in Figure 31 are statistical information collected by the system call collection unit 120 under collection condition E (the frequency with which two specific types of system calls (SCp, SCq) occur consecutively), with the upper graph showing period y1 and the lower graph showing period y2. Here, it is shown that when the consecutive count is "2," there is a change in the number of occurrences between period y1 and period y2.

[0119] Analysis condition e is to detect whether there is a change by comparing the intervals between occurrences of two specific types of system calls (SCp, SCq) over different time periods. The upper and lower graphs denoted by reference numeral 315 in Fig. 31 are statistical information collected by the system call collection unit 120 under collection condition F (the intervals between occurrences of two specific types of system calls (SCp, SCq)), with the upper graph showing period y1 and the lower graph showing period y2. Here, it is analyzed that there is no change in the intervals between occurrences of the two specific types of system calls (SCp, SCq) between period y1 and period y2.

[0120] The analysis result aggregation unit 132 aggregates the results of the analysis performed under each analysis condition (analysis results), and transmits them to the communication network system management device 8 .

[0121] <Hardware Configuration> The computers (communication network devices) 5 (5A, 5B) and system call analysis devices 1 (1A, 1B) of the system call analysis system 1000 (1000A, 1000B) according to this embodiment are realized by a computer 900 having a configuration such as that shown in FIG. 32 . FIG. 32 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the computers (communication network devices) 5 (5A, 5B) and system call analysis devices 1 (1A, 1B) of the system call analysis system 1000 (1000A, 1000B) according to this embodiment. The computer 900 includes a CPU 901, a ROM (Read Only Memory) 902, a RAM 903, an HDD (Hard Disk Drive) 904, an input / output I / F (Interface) 905, a communication I / F 906, and a media I / F 907.

[0122] The CPU 901 operates based on a program stored in the ROM 902 or the HDD 904, and performs control by the computer (communication network device) 5 (5A, 5B) and the system call analysis device 1 (1A, 1B). The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started, programs related to the hardware of the computer 900, and the like.

[0123] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0124] The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I / F 906 receives data from other devices via a communication network (e.g., NW (Network) 920) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0125] The media I / F 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical Disc), a magnetic recording medium, a semiconductor memory, or the like.

[0126] For example, when a computer 900 functions as the computer (communication network device) 5 (5A, 5B) or system call analysis device 1 (1A, 1B) of the present invention, a CPU 901 of the computer 900 executes a program loaded onto a RAM 903 to realize the functions of the computer (communication network device) 5 (5A, 5B) and the system call analysis device 1 (1A, 1B). Furthermore, data stored in the RAM 903 is stored in the HDD 904. The CPU 901 reads and executes a program related to a target process from a recording medium 912. Alternatively, the CPU 901 may read a program related to a target process from another device via a communication network (NW 920).

[0127] <Effects> The following describes the effects of the system call analysis system 1000 (1000A, 1000B) etc. according to the present invention. The system call analysis system 1000 (1000A, 1000B) according to the present invention is a system call analysis system 1000 (1000A, 1000B) including one or more computers (communication network devices) 5 and a system call analysis device 1 that analyzes system calls of the computer 5, wherein the computer 5 includes a system call extraction unit 520 that extracts, via a kernel 500 of the computer 5, system calls issued by applications (VNFs) 300 installed on the computer 5, and a system call transfer unit 530 that transfers information on the extracted system calls to the system call analysis device 1, and the system call analysis device 1 includes a system call collection unit 110 that collects system call information from the computer 5, and a system call analysis unit 130 that analyzes statistical information obtained from the collected multiple system calls and detects an abnormality in the application 300.

[0128] In this way, the system call analysis system 1000 (1000A, 1000B) can obtain information regarding abnormalities or failures in the application 300 by statistically analyzing information on system calls issued by the application 300 extracted from the kernel 500 of the computer 5 (communication network device 5).

[0129] Furthermore, the system call analysis system 1000 (1000B) is characterized in that the system call analysis device 1 further includes a condition setting unit 150 that sets predetermined collection conditions for collecting system calls and predetermined analysis conditions for analyzing statistical information obtained from the system calls.

[0130] In this way, the system call analysis system 1000 (1000B) can grasp symptoms of abnormalities, failures, etc. in more detail by changing the setting conditions for collecting and analyzing system calls.

[0131] The present invention is not limited to the above-described embodiments, and many modifications can be made by a person skilled in the art within the technical concept of the present invention.

[0132] DESCRIPTION OF SYMBOLS 1, 1A, 1B System call analysis device 5, 5A, 5B Computer (communication network device) 8 Communication network system management device 10 Selection unit 20 Accumulation unit 110 System call collection unit 111 Output processing unit 120 System call tallying unit 121 Tallying and sorting unit 130 System call analysis unit 131 Analysis and sorting unit 132 Analysis result aggregation unit 140 Data storage unit 150 Condition setting unit 300 Application (VNF) 400 Collected data 450 Tallying data 500 Kernel 520 System call extraction unit 521 Replication unit 522 Output unit 530 System call transfer unit 531 Transfer processing unit 540 eBPF function and condition setting unit 550 Condition setting processing unit 1000, 1000A, 1000B System call analysis system

Claims

1. A system call analysis system comprising one or more computers and a system call analysis device that analyzes system calls of the computers, wherein the computers comprise: a system call extraction unit that extracts system calls issued by applications installed on the computers using the computer's kernel; and a system call transfer unit that transfers information about the extracted system calls to the system call analysis device, and the system call analysis device comprises: a system call collection unit that collects information about the system calls from the computers; and a system call analysis unit that analyzes statistical information obtained from the collected multiple system calls and detects abnormalities in the applications.

2. The system call analysis system according to claim 1, wherein the system call analysis device further comprises a condition setting unit that sets predetermined collection conditions for collecting the system calls and predetermined analysis conditions for analyzing statistical information obtained from the system calls.

3. A system call analysis device that analyzes system calls of one or more computers, comprising: a system call collection unit that collects information on the system calls from applications extracted by the kernel of the computer; and a system call analysis unit that analyzes statistical information obtained from the collected multiple system calls and detects abnormalities in the applications.

4. A program for causing a computer to function as the system call analysis device according to claim 3.

Images