Abnormality detection method, abnormality detection device, and program

Abstract

This abnormality detection method executed by a computer comprises: a step for acquiring, from an abnormality determination device used for abnormality determination for determining abnormality or no abnormality in a log of an apparatus, a result of the abnormality determination; a step for determining, on the basis of the acquired result of the abnormality determination, whether or not there is an abnormality preliminary state which is a state in which it is determined in the abnormality determination to have no abnormality, and which is the state of a stage before it is determined that there is an abnormality; a step for receiving a handling setting corresponding to a pattern of the abnormality preliminary state when the determination result indicates that the abnormality preliminary state is present; and a step for executing handling based on the received setting.

Description

Anomaly detection method, anomaly detection device, and program

[0001] The present disclosure relates to an anomaly detection method, an anomaly detection device, and a program.

[0002] In recent years, as the Internet of Things (IoT) has become increasingly prevalent in control systems such as factories, buildings, and power systems, cyberattacks targeting such IoT devices have also been increasing. For general IT (Internet Technology) devices, measures against cyberattacks are often taken by installing security software such as Endpoint Detection and Response (EDR) into the IT devices. However, such measures are difficult to implement for IoT devices, which do not have as many resources as IT devices. Therefore, as a countermeasure against cyberattacks, IoT devices often transmit their own logs to an external analysis device, such as a cloud, and the analysis device analyzes the logs. Examples of external analysis devices include Security Information Event Management (SIEM) and EDR. These analysis devices collect logs from various devices and analyze them in an integrated manner to detect abnormalities such as cyber attacks.

[0003] As an example of such detection, Patent Literature 1 discloses a security operation system for quickly detecting the spread of damage from an attack and other attacks using the same method when an attack occurs. Patent Literature 1 describes how countermeasures are implemented preferentially for devices with a high potential threat level that are likely to cause damage to spread or be the target of similar attacks.

[0004] Japanese Patent Application Laid-Open No. 2018-169643

[0005] However, there are cases where conventionally known anomaly detection methods are inappropriate. Therefore, an object of the present disclosure is to provide an anomaly detection method and the like that enables more appropriate anomaly detection and more appropriate response.

[0006] An anomaly detection method according to one aspect of the present disclosure is an anomaly detection method executed by a computer, and includes the steps of: acquiring a result of an anomaly determination from an anomaly determination device used for an anomaly determination that determines whether an anomaly exists or not in an equipment log; determining, based on the acquired result of the anomaly determination, whether the anomaly determination determines that there is no anomaly and whether the anomaly is in a pre-abnormality state, which is a state preceding a determination that an anomaly exists; accepting, when the determination result indicates the anomaly pre-abnormality state, a response setting for the pattern of the pre-abnormality state; and executing a response based on the accepted setting.

[0007] Moreover, an anomaly detection device according to one aspect of the present disclosure includes an acquisition unit that acquires the result of the anomaly determination from an anomaly determination device used for anomaly determination that determines whether an abnormality is present or absent in a device log; a determination unit that determines, based on the acquired result of the anomaly determination, whether the device is in an abnormality pre-state, which is a state in which the device is determined to be absent in the anomaly determination and is a state preceding the state in which the device is determined to be abnormal; an input unit that, when the determination result indicates the device is in an abnormality pre-state, accepts settings for responding to the pattern of the abnormality pre-state; and an execution unit that executes a response based on the accepted settings.

[0008] Furthermore, a program according to one aspect of the present disclosure is a program for causing a computer to execute the anomaly detection method described above.

[0009] According to the present disclosure, more appropriate detection of abnormalities and more appropriate responses are possible.

[0010] FIG. 1 is a diagram illustrating an overall configuration of an anomaly detection system according to an embodiment. FIG. 2 is a diagram illustrating an overall configuration of an anomaly detection system according to an embodiment. FIG. 3 is a flowchart illustrating an example of an anomaly detection process according to an embodiment. FIG. 4 is a flowchart illustrating an example of an anomaly detection process according to an embodiment. FIG. 5 is a flowchart illustrating an example of an anomaly detection process according to an embodiment. FIG. 6 is a flowchart illustrating an example of an anomaly detection process according to an embodiment. FIG. 7 is a flowchart illustrating an example of an anomaly detection process according to an embodiment. FIG. 8 is a flowchart illustrating an example of an anomaly detection process according to an embodiment. FIG. 9 is a sequence diagram of data communication according to an embodiment. FIG. 10 is a sequence diagram of data communication according to an embodiment. FIG. 11 is a sequence diagram of data communication according to an embodiment. FIG. 12 is a sequence diagram of data communication according to an embodiment. FIG. 13 is a sequence diagram of data communication according to an embodiment. FIG. 14 is a diagram illustrating a data structure according to an embodiment. FIG. 15 is a diagram illustrating a data structure according to an embodiment. FIG. 16 is a diagram illustrating a data structure according to an embodiment. FIG. 17 is a diagram illustrating a data structure according to an embodiment. FIG. 18 is a diagram illustrating a data structure according to an embodiment. FIG. 19 is a diagram illustrating a data structure according to an embodiment. FIG. 20 is a flowchart illustrating an example of an output screen according to an embodiment.

[0011] (Knowledge forming the basis of the present disclosure) As IoT advances in the field of control systems for factories, buildings, power systems, etc., there are an increasing number of cases in which control system networks are connected to the Internet for convenience and efficiency reasons. As a result, the risk of cyber attacks is increasing for control systems, just like for IT systems, and the introduction of security measures for control systems has become an urgent issue.

[0012] Because control systems place the utmost importance on system availability, it is not easy to implement common security measures such as antivirus software or security patches, which can affect availability. For this reason, control systems often adopt a configuration in which communication logs between devices are passively acquired and sent to an analysis device such as a SIEM, which centrally collects and manages the logs and monitors for the presence or absence of cyber attacks (i.e., whether there are any abnormalities or not).

[0013] However, simply monitoring for such attacks may result in a delayed response because some of the attacks may have already been successful. Therefore, it is desirable to be able to detect attacks in their preliminary stages, i.e., in a pre-abnormality state, which is a state where no abnormality is determined, but before a determination that an abnormality is present. If detection can be made in such a pre-abnormality state, it becomes possible to take preemptive action against attacks. Furthermore, being able to detect an abnormality in a pre-abnormality state makes it possible to predict what kind of abnormality will occur later. Therefore, by selectively applying a pre-set response based on this prediction, i.e., the detection of a pre-abnormality state, more appropriate responses become possible.

[0014] In order to achieve the above, the anomaly detection method according to the first aspect of the present disclosure is an anomaly detection method executed by a computer, and includes the steps of: acquiring an anomaly determination result from an anomaly determination device used for the anomaly determination that determines whether an anomaly is present or absent in a device log; determining, based on the acquired anomaly determination result, whether the anomaly determination determines that there is no anomaly and whether the device is in an anomaly pre-state, which is a state preceding a determination that an anomaly is present; accepting, when the determination result indicates an anomaly pre-state, settings for responding to the pattern of the anomaly pre-state; and executing a response based on the accepted settings.

[0015] According to this, the abnormality determination device may detect a situation in which the result of the abnormality determination indicates no abnormality, and may include a pre-abnormality state, which is a state preceding the determination that an abnormality is present. Whether or not such a pre-abnormality state exists can be determined. If a pre-abnormality state exists, a response setting can be accepted, allowing a response based on the accepted setting to be executed for such a pattern of pre-abnormality states. As a result, by taking a response before a transition to a state that would otherwise be determined as abnormal, the abnormality determination device 200 can prevent the pre-abnormality state from transitioning to an abnormal state (before it actually occurs). This enables more appropriate abnormality detection and more appropriate response.

[0016] Furthermore, an anomaly detection method according to a second aspect of the present disclosure is the anomaly detection method described in the first aspect, in which in the judging step, the probability of transitioning from an anomaly preparatory state to a state judged to have an abnormality in the anomaly judgment is calculated, and if the calculated probability exceeds a predetermined threshold, it is judged to be in an anomaly preparatory state.

[0017] According to this, if the calculated probability exceeds a predetermined threshold, it is determined that an abnormality is occurring, and a response based on the setting can be implemented.

[0018] Furthermore, an anomaly detection method according to a third aspect of the present disclosure is the anomaly detection method described in the first or second aspect, in which the anomaly determination is performed every time a predetermined period of time has elapsed, and the receiving step receives a setting as to whether or not to link a flag that shortens the predetermined period of time when it is determined that an anomaly is in a pre-existing state.

[0019] According to this, it is possible to accept a setting for shortening the predetermined period for executing abnormality determination when it is determined that an abnormality pre-state exists.

[0020] Furthermore, an anomaly detection method according to a fourth aspect of the present disclosure is an anomaly detection method according to any one of the first to third aspects, wherein the receiving step receives a setting of whether to link a flag indicating that a response will be taken if it is determined that an abnormality pre-state exists, and if it is determined that an abnormality pre-state exists without a linked flag, the pre-set response is not taken.

[0021] According to this, when it is determined that a pre-abnormal state exists, the execution of a predetermined response can be set by linking the flag.

[0022] Furthermore, an anomaly detection method according to a fifth aspect of the present disclosure is an anomaly detection method according to any one of the first to fourth aspects, wherein the receiving step receives a setting as to whether or not to link a flag that is linked when the occurrence of an anomaly is recognized by the user, and that prohibits the execution of a preset response when it is determined that the flag is in a linked anomaly pre-state.

[0023] According to this, whether or not to prohibit the execution of a preset response when it is determined that an abnormality pre-state exists can be set by linking the flag.

[0024] Furthermore, an anomaly detection method according to a sixth aspect of the present disclosure is an anomaly detection method according to any one of the third to fifth aspects, in which a validity period is set for the flag, and the setting of whether or not to link the flag is reset after the validity period has elapsed since the judgment model determined that an anomaly is in a pre-existing state.

[0025] According to this, when the validity period has elapsed, the flag indicating the setting regarding the preset response in the case where it is determined that an abnormality pre-state exists can be reset.

[0026] Furthermore, an anomaly detection method according to a seventh aspect of the present disclosure is the anomaly detection method according to any one of the third to sixth aspects, wherein the anomaly determination device takes action against the anomaly when it determines that an anomaly exists in the anomaly determination, and the anomaly detection method further includes a step of changing the action against the anomaly determined to exist by transmitting information indicating whether or not a flag is linked to the anomaly determination device.

[0027] According to this, when an abnormality is determined to exist in the abnormality determination device, the response to the abnormality can be changed depending on whether or not the flag is linked to the abnormality determination.

[0028] Furthermore, an anomaly detection method according to an eighth aspect of the present disclosure is the anomaly detection method described in the seventh aspect, in which the changing step includes changing so as not to respond to an anomaly that is determined to be present.

[0029] According to this, the abnormality determination in the abnormality determination device can be changed so that no action is taken against the abnormality determined to be present, depending on information on whether or not a flag is linked.

[0030] Furthermore, an anomaly detection method according to a ninth aspect of the present disclosure is the anomaly detection method described in the seventh or eighth aspect, in which the modifying step includes modifying the method so as to notify the user of an anomaly that is determined to exist.

[0031] According to this, the abnormality determination device can be modified so that the user is notified of the abnormality that is determined to exist, based on information on whether or not a flag is linked to the abnormality determination.

[0032] Furthermore, an anomaly detection method according to a tenth aspect of the present disclosure is an anomaly detection method according to any one of the seventh to ninth aspects, wherein the modifying step includes modifying the anomaly determination device to calculate the impact of an anomaly that has been determined to be present, and to notify the user in accordance with the calculation result.

[0033] According to this, the abnormality determination device can calculate the impact of the abnormality that is determined to be present based on information on whether or not a flag is linked to the abnormality determination, and can be changed to notify the user according to the calculation result.

[0034] Furthermore, an anomaly detection device according to an eleventh aspect of the present disclosure includes an acquisition unit that acquires a result of the anomaly determination from an anomaly determination device used for anomaly determination that determines whether an anomaly exists or not in a device log; a determination unit that determines, based on the acquired result of the anomaly determination, whether the anomaly determination determines that there is no anomaly and that the device is in an anomaly preparatory state, which is a state preceding a determination that an anomaly exists; an input unit that, when the determination result indicates the anomaly preparatory state, accepts settings for responding to the pattern of the anomaly preparatory state; and an execution unit that executes a response based on the accepted settings.

[0035] This can achieve the same effects as the anomaly detection method described above.

[0036] A program according to a twelfth aspect of the present disclosure is a program for causing a computer to execute the anomaly detection method according to the first aspect.

[0037] According to this, by having a computer execute the method, it is possible to achieve the same effect as the anomaly detection method described above.

[0038] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Each of the embodiments described below represents a specific example of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in independent claims will be described as optional components. Furthermore, the respective contents of all the embodiments and modified examples can be combined.

[0039] In addition, the same reference numerals are used for the same components in each drawing.

[0040] Furthermore, in this specification, when a comparison is made, for example, with "above a threshold" or "below a threshold," it means that the distinction is made at the threshold, and may mean "greater than the threshold" or "below the threshold," respectively.

[0041] Furthermore, the numerical values ​​of the thresholds and the like in the present embodiment are merely examples, and other numerical values ​​may be used.

[0042] (Embodiment) [Overall Configuration] FIG. 1 is a diagram showing the overall configuration of an example of an anomaly detection system 10 according to the present embodiment.

[0043] The anomaly detection system 10 is a system that analyzes logs transmitted from devices such as IoT devices, notifies a user of the analysis results, accepts user settings, and responds to anomalies based on the accepted settings. The anomaly detection system 10 includes, for example, a device group 120 and an anomaly detection device 400.

[0044] The device group 120 includes one or more devices such as IoT devices. For example, the device group 120 is arranged at a site 110, which is a building such as a factory or a building. In other words, the device group 120, which is made up of a plurality of devices, exists at the site 110. The devices included in the device group 120 may be any device, and may be, for example, various devices such as OA (Office Automation) devices in an IT environment, controllers in a control system environment, or IP cameras (network cameras).

[0045] Each of the multiple devices included in the device group 120 (hereinafter simply referred to as the device group 120) transmits logs (also referred to as device data) such as its own internal log (i.e., a processing log indicating processes executed by the device itself) and communication data (also referred to as a communication log) between devices that have communicated with other devices as log 501 to the anomaly detection device 400. Specifically, each device included in the device group 120 records information indicating its own operation, etc. as device data, and transmits at least a portion of the recorded device data to the anomaly detection device 400 as log 501. The device data is a device log, such as a device communication log or a device operation log.

[0046] When devices included in the device group 120 communicate with each other, only one of the devices involved in the communication may transmit a communication log to the anomaly detection device 400 as the log 501. Also, each device may transmit only the communication log that it transmitted to another device or the communication log that it received from another device as the log 501. Also, any one of the multiple devices included in the device group 120 may collect the logs 501 of each device and transmit the collected log 501 to the anomaly detection device 400 on behalf of the device group 120.

[0047] The anomaly detection device 400 is a device that analyzes the log 501 transmitted from the device group 120 and takes action when an anomaly is detected. The anomaly detection device 400 includes an anomaly determination device 200 and an anomaly prevention device 300.

[0048] The abnormality determination device 200 is a computer that receives the log 501 transmitted from the device group 120 and performs an abnormality determination (an abnormality determination process) for the received log 501. Here, when an abnormality is detected in the log 501, the abnormality determination device 200 notifies an SOC analyst 900 who analyzes the abnormality at an SOC (Security Operation Center) of an alert 701. As a result, the SOC analyst 900 analyzes the cyber attack. The SOC analyst 900 is an example of a user who uses the anomaly detection device 400.

[0049] The abnormality prevention device 300 is a computer that acquires the determination result 801, which is the result of the abnormality determination, from the abnormality determination device 200, determines whether or not there is a potential abnormality state, and if there is a potential abnormality state, takes action (i.e., prevents the abnormality state). The abnormality prevention device 300 receives input from the SOC analyst 900 or the manager of the site 110 (not shown, hereinafter referred to as the site manager) as to whether or not to prevent the abnormality state, and takes action accordingly by implementing a preventive measure 601 on the group of devices 120.

[0050] When the device group 120 receives the preventive measure 601 from the abnormality prevention device 300, it operates in accordance with the preventive measure 601 to prevent the device group 120 from transitioning from a pre-abnormality state to an abnormality state (the abnormality state is prevented).

[0051] The abnormality determination device 200 and the abnormality prevention device 300 are each realized by a communication interface, a non-volatile memory storing a program, a volatile memory that is a temporary storage area for executing the program, an input / output port for transmitting and receiving signals, a processor that executes the program, etc. The communication interface may be realized by, for example, an antenna and a wireless communication circuit or the like to enable wireless communication, or by a connector to which a communication line is connected to enable wired communication.

[0052] 2 is a diagram showing the overall configuration of an abnormality detection device 400 according to this embodiment. In FIG. 2, the abnormality detection device 400 is made up of an abnormality determination device 200 and an abnormality prevention device 300.

[0053] The abnormality determination device 200 includes a communication unit 210 , an alert issuing unit 220 , an abnormality determination unit 230 , an alert response unit 240 , and a storage unit 250 .

[0054] The communication unit 210 is a communication interface for receiving the log 501 from the device group 120 at the site 110 and transmitting (transmitting) it to the abnormality determination unit 230. Note that, when the abnormality determination unit 230 cannot perform abnormality determination based on the received log 501 alone, for example, the abnormality determination unit 230 may transmit, to the device group 120 at the site 110 via the communication unit 210, information requesting the device group 120 to provide additional logs for abnormality determination, and may acquire the log 501 including items necessary for abnormality determination from the device group 120. The communication unit 210 may include a wired communication interface or a wireless communication interface. The communication unit 210 may also include a processing unit such as a memory and a processor for transmitting and receiving various information.

[0055] The alert issuing unit 220 is a processing unit that issues an alert 701 based on the result of an abnormality determination by the abnormality determination unit 230 (described later). The alert 701 is a notification that notifies the SOC analyst 900 that an abnormality has occurred, and is information for generating a stimulus, such as sound or light, that acts on the five senses of the SOC analyst 900. As an example, the alert 701 may be notified to the SOC analyst 900 using a tool such as email, or may be displayed on a display device such as a display provided on a computer or mobile terminal used by the SOC analyst 900. In this case, the alert issuing unit 220 may be a processing unit that transmits the alert 701 to the computer or mobile terminal used by the SOC analyst 900 via the communication unit 210.

[0056] The abnormality determination unit 230 is a processing unit that performs abnormality determination on the log 501 received via the communication unit 210 based on a preset abnormality determination model.

[0057] Each of the preset anomaly determination models is a rule including a predetermined condition that uses one or more elements from among multiple elements included in the device log. In other words, the anomaly determination model is a rule for determining whether one or more elements (specifically, values ​​corresponding to the elements) satisfy a predetermined condition. For example, the predetermined conditions included in each anomaly determination model are different from each other, and the one or more elements used in each anomaly determination model differ from each other by one or more. The predetermined condition is, for example, an element included in Condition, which will be described later.

[0058] The alert response unit 240 is a processing unit that responds to the issuance of an alert by determining that the log 501 in which an abnormality is found is no abnormality.

[0059] The storage unit 250 is realized by, for example, a hard disk drive (HDD) or a solid state drive (SSD), and is a storage device that stores a log 501 of abnormality determinations made by the abnormality determination unit 230 and the results of the abnormality determinations.

[0060] The processing units such as the abnormality determination unit 230 are realized by, for example, a processor that executes a control program and a memory that stores the control program.

[0061] The abnormality prevention device 300 includes an abnormality determination result analysis unit 310 , an abnormality preventive measure execution unit 320 , a communication unit 330 , a user input analysis unit 340 , and a storage unit 350 .

[0062] The abnormality determination result analysis unit 310 is a processing unit that determines whether or not an abnormality is in a pre-abnormal state by acquiring and analyzing the determination result 801, which is the result of the abnormality determination. The abnormality determination result analysis unit 310 is an example of an acquisition unit that acquires the result of the abnormality determination and an assessment unit that determines whether or not an abnormality is in a pre-abnormal state.

[0063] The abnormality preventive measure execution unit 320 is an example of an execution unit, and is a processing unit that executes a response to an abnormality pre-condition based on pre-prepared settings. For each pattern of an abnormality pre-condition, the abnormality preventive measure execution unit 320 executes a response according to the abnormality pre-condition of that pattern. Therefore, settings related to the above response are prepared in advance for each pattern of an abnormality pre-condition.

[0064] The communication unit 330 is a communication interface for receiving the determination result 801 from the abnormality determination device 200 and transmitting (sending) it to the abnormality determination result analysis unit 310. The communication unit 330 is also a communication interface for receiving information input from the SOC analyst 900 and transmitting (sending) it to the user input analysis unit 340. The communication unit 330 is also a communication interface for transmitting the preventive measure 601 from the abnormality preventive measure execution unit 320 to the device group 120 of the site 110. The communication unit 330 may include a wired communication interface or a wireless communication interface. The communication unit 330 may also include a processing unit such as a memory and a processor for transmitting and receiving various information.

[0065] The user input analysis unit 340 is an example of an input unit, and when the abnormality determination result analysis unit 310 subsequently determines that an abnormality is in a preliminary abnormality state, receives an input indicating whether or not to link a flag to the determination model that led to the determination that an abnormality is in a preliminary abnormality state. The user input analysis unit 340 receives input from, for example, the SOC analyst 900 or the site manager, analyzes the input content, and assigns a flag to the determination model and stores the information in the storage unit 350 as a user input analysis result.

[0066] The memory unit 350 is realized, for example, by an HDD or the like, and is a storage device that stores the judgment results by the abnormality judgment result analysis unit 310, the preventive measures 601 by the abnormality preventive measures execution unit 320 (i.e., a list of responses for each pattern of abnormality preparatory state), the analysis results by the user input analysis unit 340, and other incidentally generated information.

[0067] The communication interface (not shown) provided in the abnormality prevention device 300 may be a wired communication interface or a wireless communication interface as long as it can communicate with the abnormality determination device 200.

[0068] [Processing Procedure] Figures 3 to 8 are flowcharts showing an example of an anomaly detection process executed by the anomaly detection device 400 in this embodiment. Figures 9 to 13 are sequence diagrams of communications and the like that occur in conjunction with each process. Figures 14 to 19 are diagrams showing data structures of information used in each process. Figure 20 is a diagram showing an example of an output screen that is output as a result of each process.

[0069] 3 , the communication unit 330 of the abnormality prevention device 300 makes an inquiry to the abnormality determination device 200, and when there is an abnormality determination result (Yes in S11), receives this determination result 801 and causes the abnormality determination result analysis unit 310 to acquire it. When there is no abnormality determination result (No in S11), the communication unit 330 continues to make periodic inquiries and continue to receive the determination result 801.

[0070] 14, each of the judgment results 801 is composed of a judgment result (true / false in "elements") as to whether or not each of a plurality of elements satisfies the condition for a judgment model ("model-01" in the figure), and information (true / false in result) as to whether or not an abnormality is present in the abnormality judgment of the judgment model based on the judgment result for each element. Such information is generated sequentially, and the judgment results 801 at a plurality of points in time are accumulated in the storage unit 250, as shown in FIG.

[0071] Returning to Fig. 3, the abnormality determination result analysis unit 310 receives such information and performs a process for determining a potential abnormality state (S12). In the process for determining a potential abnormality state, as shown in Fig. 4, first, a determination result 801 is obtained, including past abnormality determination results (S21). Information on whether the information indicating whether an abnormality is present or absent, indicated in the determination result, has changed from false to true or has not changed from a certain determination result to a subsequent determination result is compiled, and the probability of falling into an abnormal state for the certain determination result is calculated (S22). The subsequent subsequent determination result may be the time point immediately following the time point at which the certain determination result was obtained, or may be a time point within a predetermined period from the time point at which the certain determination result was obtained.

[0072] If the calculated probability is equal to or greater than a predetermined threshold (Yes in S23), an abnormality pre-condition flag is set, and the combination of the determination results of whether each of the multiple elements satisfies the condition is set to be an abnormality pre-condition (S24). On the other hand, if the calculated probability is less than the predetermined threshold (No in S23), step S24 is skipped and the process ends.

[0073] 3 , if the calculated probability is equal to or greater than a predetermined threshold in step S23 and the system is deemed to be in a potential abnormality state (Yes in S13), a flag is set in the determination model for the determination result, as described in step S24, for a combination pattern of the determination results, which indicates whether each of the multiple elements satisfies the condition (S16), and the system proceeds to a user input analysis process (S17). In the user input analysis process, as shown in FIG. 5 , a result indicating that the system is in a potential abnormality state is output to the user (S31). For example, as shown in FIG. 20 , a screen is displayed, and the user's input is accepted by selecting "Yes" or "No."

[0074] If the user recognizes that the combination of the determination results of whether each of the multiple elements satisfies the conditions in the determination model for that determination result includes an operation that could result in an abnormal state, the user selects "Yes" for Q2 to indicate their recognition. The result in step S32 is "Yes," and a recognition flag is assigned to the combination of the determination results of whether each of the multiple elements satisfies the conditions in the determination model pattern for that determination result (S33). If the user selects "No" for Q2, the result in step S32 is "No," and step S33 is skipped. Furthermore, a query regarding whether or not to take measures to prevent the abnormal state is output to the user (S34). For example, as shown in FIG. 20 , a screen is displayed, and the user's input is accepted by selecting "Yes" or "No."

[0075] If the user believes that it is necessary to prevent an abnormal state in a combination of the determination results of whether or not each of the multiple elements satisfies the condition in the determination model pattern for that determination result, the user selects “Yes” for Q1 to input that the abnormal state should be prevented. The result in step S35 is “Yes,” and an abnormal state prevention flag is assigned to the combination of the determination results of whether or not each of the multiple elements satisfies the condition in the determination model for that determination result (S36). In this way, for a pattern of a potential abnormal state in which a certain combination of multiple elements satisfies the condition in a certain determination model, a flag setting input from the user can be accepted, and a response to that pattern can be set. The settings are prepared for each pattern of combinations of multiple elements in a potential abnormal state in which the condition is satisfied, and a list of responses to each of the multiple patterns of potential abnormal states is created. If the user selects “No” for Q1, the result in step S35 is “No,” and step S36 is skipped. Furthermore, the user input analysis process may include a query for assigning other flags and an acceptance of the user's response input. The other flags will be described later.

[0076] Returning to Figure 3, the results of the user input analysis process are stored in the memory unit 350 as information on whether or not a flag has been assigned (whether or not a flag is linked) for the combination of judgment results of whether or not each of the multiple elements satisfies the conditions in the judgment model for that judgment result (S18).

[0077] On the other hand, if the calculated probability is less than the predetermined threshold in step S23 and the state is not considered to be in a pre-abnormality state (No in S13), the process further determines whether the previous determination result was determined to be in a pre-abnormality state (S14). If the previous determination result was determined to be in a pre-abnormality state (Yes in S14), the state has changed from a pre-abnormality state to a non-pre-abnormality state, and the flag setting for the combination of determination results, which determine whether each of the multiple elements satisfies the condition, in the determination model for the previous determination result is reset (S15). On the other hand, if the previous determination result was not determined to be in a pre-abnormality state (No in S14), there is no determination model for the past determination result to which a flag is assigned, so step S15 is skipped.

[0078] By the above process, for each judgment model, as shown in FIG. 16 , for a Condition corresponding to a judgment result indicating whether each of a plurality of elements satisfies a condition, flag setting information indicating whether the Condition corresponds to the potential abnormal state, such as whether a recognition flag ("Known flag") is assigned, whether an abnormal state prevention flag ("Prevention flag") is assigned, and whether a short period flag ("Short Period flag") is assigned, is stored in the storage unit 350. Each flag is set with a validity period ("Expired Datetime") based on the time elapsed since the flag was set. In other words, after the validity period has elapsed since the flag was set, the flag is reset.

[0079] The shortening flag is a flag for shortening the cycle of abnormality determination using a determination model related to the abnormality preparatory state, and is an example of other flags. Abnormality determination is repeatedly performed according to a certain cycle. In other words, abnormality determination is performed every time a predetermined period defining the cycle elapses, and if a shortening flag is assigned, the predetermined period is shortened. In other words, the information on the flag assignment settings stored in the storage unit 350 is also used by the abnormality determination device 200. In addition, for example, the information on the flag assignment settings stored in the storage unit 350 is transmitted from the abnormality prevention device 300 to the abnormality determination device 200, and is used to change the response when the abnormality determination device 200 determines that an abnormality exists.

[0080] As an example, for a determination model with an abnormal state prevention flag assigned, a combination of determination results of whether each of multiple elements satisfies a condition is modified, such as automatically closing the alert 701 or notifying the user. Alternatively, for a determination model with no abnormal state prevention flag assigned but a recognition flag assigned, a combination of determination results of whether each of multiple elements satisfies a condition is modified, such as issuing a notification to instruct the user on how to respond to the alert 701. Furthermore, for a determination model with neither an abnormal state prevention flag nor a recognition flag assigned, a combination of determination results of whether each of multiple elements satisfies a condition is modified, such as causing the abnormality determination device 200 to calculate the impact of the alert 701 on the system. If the calculation result indicates a high impact, a modification is made, such as notifying the user by turning on a physical patrol light (registered trademark). The impact is managed, for example, in the form of a "Severity" for each model, as shown in FIG. 17 . For example, if the "Severity" is "High," the above-mentioned patrol light (registered trademark) is turned on.

[0081] Next, the execution of preventive measures by the anomaly preventive measure execution unit 320 of the anomaly prevention device 300 will be described with reference to Figures 6 and 9. As shown in Figures 6 and 9, information regarding the assignment of flags is acquired as a result of user input analysis (S41), and a correspondence list prepared in advance corresponding to each pattern of anomaly preparatory states of the judgment model is also acquired, as shown in Figure 18. Possible types of correspondence include some kind of correspondence to prevent the anomaly judgment from reaching an abnormality judgment, such as communication interruption or parameter rewriting. In both of the examples shown in the figures, settings are made assuming a correspondence of communication interruption.

[0082] 6 and 9, if the determination result of whether or not the current state is an abnormality preparatory state indicates that there is an abnormality preparatory state for which a setting to prevent has been made (an abnormality state prevention flag has been assigned) (Yes in S42), then the system determines a preventive measure for the target pattern of the abnormality preparatory state by referring to, for example, the correspondence list shown in Fig. 18, and transmits the preventive measure to the device group 120 or another device connected to the device group 120, thereby executing the preventive measure (S43). If there is no pattern of an abnormality preparatory state for which a setting to prevent has been made (No in S42), the system skips step S43 and ends the process.

[0083] Next, the operation of the abnormality determination device 200, such as abnormality determination, will be described with reference to Figures 7 and 8. Note that each step in Figure 7 corresponds to step S50 in the sequence diagrams in Figures 10 to 13. In the following description, these sequence diagrams will also be referenced as appropriate.

[0084] As shown in FIGS. 10 to 13, first, the abnormality determination device 200 receives a log to be subjected to abnormality determination from the device group 120 and acquires it as shown in FIG. 7 (S51). The log has a data structure, for example, as shown in FIG. 19. The multiple items constituting the log include nine columns: uid, ts, ip_src, port_src, ip_dst, port_dst, protocol, nw_bytes, and nw_status. uid is a column (item) indicating an identifier for uniquely identifying the communication log. ts is a column indicating the date and time when the communication was observed. ip_src is a column indicating the source IP address of the source device. port_src is a column indicating the source port number of the source device. ip_dst is a column indicating the destination IP address of the destination device. "port_dst" is a column indicating the destination port number of the destination device. "protocol" is a column indicating the type of protocol used for communication between the source device and the destination device. "nw_bytes" is a column indicating the amount of communication between the source device and the destination device. "nw_status" is a column indicating the status of whether the communication between the source device and the destination device was successful.

[0085] Thereafter, as shown in FIGS. 10 to 13, the abnormality determination device 200 performs the abnormality determination process (S50).

[0086] 7, the abnormality determination device 200 acquires an abnormality determination model such as that shown in FIG. 17 (S52), and further acquires information regarding flag assignment as a user input analysis result (S53). Then, if there is a target model to be executed among the acquired abnormality determination models (Yes in S54), the abnormality determination device 200 executes an abnormality determination using the target model (S55). If there is no target model to be executed (No in S54), the subsequent processing is skipped and the process ends.

[0087] Based on the acquired log, the abnormality determination device 200 determines whether the parameters included in the log satisfy each threshold, etc., to determine whether each element is true or false, and determines whether the combination of the determination results matches the abnormality determination model (S56). If the log matches the abnormality determination model (Yes in S56), an alert is issued for the log to notify the user (S57), as shown in FIGS. 12 and 13. The process then proceeds to alert response processing (S58). If the log does not match the abnormality determination model (No in S56), the abnormality determination result is transmitted to the abnormality prevention device 300 in response to an inquiry from the abnormality prevention device 300, as shown in FIGS. 10 and 11 (S59). If the abnormality determination result has been transmitted to the abnormality prevention device 300, the process proceeds to determining whether an abnormality is in a pre-existing state (S12), as described with reference to FIG. 3. As shown in Figures 3 and 11, if it is determined that the device is not in a potential abnormality state, the process ends, whereas as shown in Figures 3 and 10, if it is determined that the device is in a potential abnormality state, interaction with the user begins. Specifically, the abnormality prevention device 300 inputs and outputs information for accepting user input, and performs user input analysis processing (S17). The process thereafter is as described in Figures 6 and 9.

[0088] When the process proceeds to the alert response process (S58), as shown in FIGS. 8, 12, and 13, a change in the response of the abnormality determination device 200 occurs using information about the flag setting. Specifically, as shown in FIGS. 8 and 12, if a recognition flag is set (Yes in S61), an automatic closure process is performed for the issued alert (S62). For example, even if an alert is issued, the process is performed to cancel the alert. Then, a screen output is directed to the user (S63), notifying the user that the alert has been closed.

[0089] On the other hand, as shown in FIGS. 8 and 13 , if the recognition flag is not set (No in S61), the abnormality determination device 200 calculates the magnitude of the impact of the issued alert in the presence of an abnormality in the corresponding determination model (by referring to [Severity] in FIG. 17 ), and if the impact is relatively high, for example, greater than a threshold (Yes in S64), it issues a notification such as by turning on a physical PATLITE (registered trademark) (S65). Then, by outputting a message to the user on the screen (S63), the user is notified that the alert has not been recognized by the user and that the impact is high. This notification, as shown in FIG. 13 , includes an instruction to the user to analyze the alert.

[0090] If the impact is relatively small, for example, equal to or less than the threshold (No in S64), step S65 is skipped. After that, a message is output to the user on the screen (S63), informing the user that the alert has not been recognized by the user, but that the impact is small.

[0091] As described above, in the anomaly detection device 400, the anomaly determination device 200 and the anomaly prevention device 300 work cooperatively, allowing the definition of an abnormality pre-state and its corresponding response to be dynamically updated through interaction with the user based on the results of the abnormality determination. As a result, the anomaly determination device 200 can determine the presence or absence of an abnormality pre-state before the state transitions to a state that would otherwise be determined to be abnormal. By taking action against at least some of the abnormality pre-states, the anomaly determination device 200 can prevent the abnormality pre-state from transitioning to an abnormal state (before it actually occurs). This enables more appropriate anomaly detection and more appropriate response.

[0092] Other Embodiments Although the anomaly detection method and the like according to the present disclosure have been described above based on the embodiments, the present disclosure is not limited to the above-described embodiments and modifications.

[0093] For example, the present disclosure may be embodied as the above-described methods. Furthermore, the present disclosure may be embodied as a computer program for implementing these methods on a computer, or as a digital signal comprising a computer program. For example, one aspect of the present disclosure may be a computer program for causing a computer to execute each of the characteristic steps included in the log priority calculation method.

[0094] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0095] The present disclosure may also be applied to transmitting a computer program or digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0096] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0097] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0098] Furthermore, the above-described embodiments and modifications may be combined with each other. Furthermore, various modifications that a person skilled in the art may conceive of may be made to the present embodiment, and configurations constructed by combining components of different embodiments may also be included in the present disclosure, as long as they do not deviate from the spirit of the present disclosure.

[0099] The present disclosure is useful for an apparatus for detecting an abnormality.

[0100] 10 Anomaly detection system 110 Site 120 Device group 200 Anomaly determination device 210, 330 Communication unit 220 Alert issuing unit 230 Anomaly determination unit 240 Alert response unit 250, 350 Storage unit 300 Anomaly prevention device 310 Anomaly determination result analysis unit 320 Anomaly prevention measure execution unit 340 User input analysis unit 400 Anomaly detection device 501 Log 601 Preventive measure 701 Alert 801 Determination result 900 SOC analyst

Claims

1. An anomaly detection method executed by a computer, comprising the steps of: acquiring a result of an anomaly determination from an anomaly determination device used for anomaly determination that determines whether an abnormality is present or absent in a device log; determining, based on the acquired result of the anomaly determination, whether the anomaly determination determines that there is no abnormality and whether the device is in a pre-abnormality state, which is a state preceding a determination that an abnormality is present; accepting settings for a response to the pattern of the pre-abnormality state when the determination result indicates that the device is in the pre-abnormality state; and executing a response based on the accepted settings.

2. The anomaly detection method according to claim 1, wherein in the determining step, the probability of transitioning from the pre-abnormality state to a state determined to be abnormal in the anomaly determination is calculated, and the anomaly detection method determines that the anomaly is in the pre-abnormality state when the calculated probability exceeds a predetermined threshold value.

3. The anomaly detection method according to claim 1, wherein the abnormality determination is performed every time a predetermined period of time has elapsed, and the receiving step receives a setting as to whether or not to link a flag that shortens the predetermined period of time when it is determined that the system is in the pre-abnormal state.

4. The anomaly detection method according to claim 1, wherein the receiving step receives a setting for whether or not to link a flag indicating that a countermeasure will be taken if it is determined that the abnormality is in a pre-existing state, and if it is determined that the abnormality is in a pre-existing state to which the flag is not linked, the pre-existing state is not taken.

5. The anomaly detection method according to claim 1, wherein the receiving step receives a setting as to whether or not to link a flag that is linked when the occurrence of an abnormality is recognized by the user and that prohibits the execution of a preset response when it is determined that the abnormality is in a pre-abnormal state to which the flag is linked.

6. The anomaly detection method according to any one of claims 3 to 5, wherein a validity period is set for the flag, and after the validity period has elapsed since it was determined that the anomaly is in a pre-existing state, the setting as to whether or not to link the flag is reset.

7. The anomaly detection method according to any one of claims 3 to 5, wherein the anomaly determination device takes action to deal with the anomaly when it is determined that an anomaly exists in the anomaly determination, and the anomaly detection method further includes a step of changing the action to deal with the anomaly determined to exist by transmitting information as to whether or not the flag is linked to the anomaly determination device.

8. The anomaly detection method according to claim 7, wherein the step of making a change includes making a change so as not to respond to an anomaly that has been determined to be present.

9. The anomaly detection method according to claim 7, wherein the step of changing includes changing the system so as to notify a user of an anomaly that has been determined to exist.

10. The anomaly detection method according to claim 7, wherein the changing step includes causing the anomaly determination device to calculate the impact of an anomaly that has been determined to be present, and changing the step to notify the user in accordance with the calculation result.

11. An anomaly detection device comprising: an acquisition unit that acquires the results of an anomaly judgment from an anomaly judgment device used for anomaly judgment that determines whether an abnormality is present or absent in a device log; a judgment unit that judges, based on the acquired results of the anomaly judgment, whether the anomaly judgment determines that there is no abnormality and whether the device is in a pre-abnormality state, which is a state preceding a determination that an abnormality is present; an input unit that, when the judgment result indicates the pre-abnormality state, accepts settings for responding to the pattern of the pre-abnormality state; and an execution unit that executes a response based on the accepted settings.

12. A program for causing the computer to execute the anomaly detection method according to claim 1.

Images