System call collection system and system call collection method

Abstract

A system call collection system (100) comprises: communication servers (10) that make up a network system; an analysis server (20) that analyzes system call information collected at each communication server (10); and a maintenance server (30) that, on the basis of the magnitude relation of processing loads according to the network topology of the network system, changes the collection amount of system call information that each communication server (10) collects from itself.

Description

System call collection system and system call collection method

[0001] The present invention relates to a system call collection system and a system call collection method.

[0002] In network systems such as the 5th Generation Core network (5GC), various network functions are defined as network functions (NFs), and a wide variety of communication services can be provided by combining NFs. Virtualized NF (VNF), which realizes NFs as containers, a type of virtualization technology, has also been proposed.

[0003] In order to operate a network system normally and stably, it is necessary to detect signs of abnormalities or failures in the servers that make up the network system. Examples of such detection technologies are as follows: Patent Document 1 describes the use of statistical information on the issuance of system calls by a host OS (Operating System). Non-Patent Document 1 describes an EDR (Endpoint Detection and Response) product that detects signs of abnormalities by monitoring statistical information on system calls.

[0004] JP 2011-258019 A

[0005] Falco, "The Falco Project," [online], [Retrieved April 1, 2024], Internet <URL: https: / / falco.org / docs / >

[0006] Conventional security tools such as those described in Patent Document 1 and Non-Patent Document 1 detect abnormal symptoms in a single server. On the other hand, when multiple communication servers cooperate to provide a network service and abnormal symptoms occur in multiple servers, it is necessary to collect system call information from all communication servers.

[0007] This increases the amount of collected system call information, which increases the processing load on the analysis system that analyzes the collected information.On the other hand, if the amount of collected information from all communication servers is uniformly reduced, the detection accuracy will also decrease.

[0008] Therefore, a main object of the present invention is to improve detection accuracy while reducing the processing load of system call information used for anomaly detection in a network in which multiple communication servers cooperate.

[0009] In order to solve the above problems, the system call collection system of the present invention comprises the following means: The present invention is characterized by comprising: communication servers constituting a network system; and a maintenance server that changes the amount of system call information collected by each of the communication servers based on the magnitude relationship of the processing load according to the network topology of the network system.

[0010] According to the present invention, it is possible to improve detection accuracy while reducing the processing load of system call information used for anomaly detection in a network in which multiple communication servers cooperate.

[0011] FIG. 1 is a configuration diagram of a system call collection system according to the present embodiment. FIG. 2 is a network diagram showing a first example of a topology stored in a topology storage unit according to the present embodiment. FIG. 3 is a network diagram in which a collection amount calculated by a collection amount calculation unit is added to the first example of FIG. 2 according to the present embodiment. FIG. 4 is a network diagram in which a collection amount calculated by a collection amount calculation unit is added to the second example of FIG. 4 according to the present embodiment. FIG. 5 is a sequence diagram showing an overview of the operation of the system call collection system based on the topologies of FIG. 4 and FIG. 5 according to the present embodiment. FIG. 6 is a flowchart showing the operation of a maintenance server according to the present embodiment. FIG. 7 is a hardware configuration diagram of each device of the system call collection system according to the present embodiment.

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0013] FIG. 1 is a configuration diagram of a system call collection system 100. The system call collection system 100 is configured by connecting multiple communication servers 10, an analysis server 20, and a maintenance server 30 via a network. The communication servers 10 that relay data form a network system as shown in FIG. 2. The analysis server 20 analyzes the system call information collected by each communication server 10 to detect the occurrence (or signs) of an abnormality (failure) in the communication server 10. The maintenance server 30 changes the amount of system call information collected (hereinafter referred to as "collection amount") that each communication server 10 collects from itself based on the magnitude relationship of the processing load according to the network topology (hereinafter referred to as "topology") of the network system.

[0014] Here, the collected system call information is information on system calls executed by the kernel 14 of each communication server 10. On the other hand, the collection amount determined by the maintenance server 30 is not limited to system call information, and may be any event information (log information) generated in each communication server 10. The maintenance server 30 then sets condition settings in the communication server 10 that reflect the determined collection amount. Furthermore, based on the analysis results of the analysis server 20, the maintenance server 30 changes the collection amount at a location where an abnormality (failure) of the communication server 10 is detected.

[0015] The communication server 10 includes a virtualization infrastructure layer 10V that provides OS functions and an application layer 10A that runs on the virtualization infrastructure layer 10V. The application layer 10A includes an application 11 for providing services such as VNF, a topology collection unit 12 that collects topology related to the communication server 10, and a collection control unit 13 that controls a system call collection unit 15. The virtualization infrastructure layer 10V includes a kernel 14, which is a core function of the OS, and a system call collection unit 15 that collects system calls from the kernel 14. The collection control unit 13 specifically instructs the system call collection unit 15 to control system call collection in accordance with condition settings notified from the maintenance server 30 via the analysis server 20. If the OS is Linux (registered trademark), the system call collection unit 15 can be implemented in the kernel 14 using eBPF (extended Berkeley Packet Filter).

[0016] The maintenance server 30 has a topology storage unit 31, a collection amount calculation unit 32, and a condition setting unit 33. The topology storage unit 31 stores the topology of the network system formed by the communication server 10. The topology storage unit 31 stores the topology notified by the topology collection unit 12 or the topology input by the administrator. The topology is the placement information of the communication server 10 that indicates how the communication server 10 is connected to other devices. For example, the communication server 10 is classified into the following types according to the topology: - Gateways that are entrances and exits to other networks. - Servers that provide relay services within the network. - Servers that send and receive data to and from end users. The topology can also be considered a network diagram that shows, in a wide area, how the hardware of the communication server 10 (nodes representing devices and links representing lines) is connected.

[0017] The collection amount calculation unit 32 varies the amount of system call information collected by each communication server 10 according to the network topology of the network system. For example, the collection amount calculation unit 32 predicts the processing load of each communication server 10 according to the network topology of the network system, and varies the amount of system call information collected by each communication server 10 according to the processing load. The collection amount calculation unit 32 differentiates the collection amounts of each communication server 10, for example, so that the greater the predicted processing load, the smaller the collection amount. When the analysis server 20 analyzes that each communication server 10 is operating normally, the collection amount calculation unit 32 of the maintenance server 30 calculates the processing load according to the network topology status of each communication server 10 based on the position of each communication server 10 according to the network topology (first policy below) or the traffic volume of each communication server 10 according to the network topology (second policy below) (see FIG. 3 for details).

[0018] (First Policy) The collection volume calculation unit 32 references the location of each communication server 10 according to the network topology. For example, a gateway server is located at the boundary between network systems operated by different organizations. Therefore, due to the structure of the communication network, gateway servers constantly have a large amount of processing traffic, and therefore tend to have a higher processing load than non-gateway servers. Therefore, the collection volume calculation unit 32 calculates the collection volume of system call information for gateway servers with little spare capacity to be less than the collection volume of non-gateway servers with more spare capacity.

[0019] (Second Policy) The collection volume calculation unit 32 refers to the traffic volume according to the network topology of each communication server 10. Although the traffic volume fluctuates over time, as the number of users accommodated by each communication server 10 increases, the traffic volume to be processed and the processing load also tend to increase. Therefore, the collection volume calculation unit 32 predicts that a communication server 10 accommodating a smaller number of users will have a lower processing load than a communication server 10 accommodating a larger number of users. The collection volume calculation unit 32 then calculates the collection volume of system call information for a communication server 10 accommodating a smaller number of users (larger spare capacity) to be larger than the collection volume for a communication server 10 accommodating a larger number of users (smaller spare capacity).

[0020] Furthermore, when the analysis server 20 detects signs of an abnormality in a first server (detection server) among the communication servers 10, the collection volume calculation unit 32 increases the collection volumes in the first server and in a second server (nearby server) that is a first predetermined number of hops (e.g., "0") or less from the first server, and decreases the collection volume in a third server (distant server) that is a second predetermined number of hops (e.g., "2") or more from the first server (see FIG. 5 for details). Note that although the number of hops is used as an example of an index for determining the near server and the distant server from the detection server, other network distances (metrics) such as delay may also be used.

[0021] The condition setting unit 33 determines condition settings for collecting system call information for each communication server 10 in accordance with the collection volume for each communication server 10 calculated by the collection volume calculation unit 32. The following are examples of condition settings created by the condition setting unit 33. The type of VNF to be collected is changed depending on the collection volume for each communication server 10. For example, to reduce the collection volume, the condition setting unit 33 creates a condition setting to reduce the types of VNF to be collected (types of applications 11 that call system calls). The type of system call to be collected is changed depending on the collection volume for each communication server 10. For example, to reduce the collection volume, the condition setting unit 33 creates a condition setting to reduce the types of system calls (function names, etc.) to be collected. The frequency of the collection process is changed depending on the collection volume for each communication server 10. For example, when reducing the amount of collection, the condition setting unit 33 creates a condition setting that thins out (samples) the collection frequency, such as reducing the frequency of the start time of the collection process, reducing the collection time for one collection process, or reducing the collection capacity for one collection process.

[0022] FIG. 2 is a network diagram showing a first example of a topology stored in the topology storage unit 31. The topology in FIG. 2 shows a network system in which the communication server 10 in FIG. 1 is connected to seven communication servers 111 to 117. Furthermore, the communication servers 111 and 113 marked with [GW] in the communication server box are gateway servers (GW is an abbreviation for gateway), and servers without [GW] are non-gateway servers. Furthermore, the communication server 116 marked with [US Few] in the communication server box accommodates fewer users (US is an abbreviation for user) than the other servers. On the other hand, the communication server 114 marked with [US Many] in the communication server box accommodates more users than the other servers.

[0023] FIG. 3 is a network diagram in which the collection volume calculated by the collection volume calculation unit 32 is added to the first example in FIG. 2 . As a result of the calculation by the collection volume calculation unit 32, either "low collection" (the lowest collection volume), "current collection" (a medium collection volume), or "high collection" (the highest collection volume) is added to the box for each communication server. For example, the [GW → low collection] in the box for the communication server 111 indicates that the calculation result of the collection volume calculation unit 32, "low collection," was output due to the characteristics of the gateway server (GW) topology. According to the (first policy) described in FIG. 1 , the collection volume calculation unit 32 calculates the collection volume (low collection) of the gateway server communication servers 111 and 113 to be less than the collection volume (current collection or high collection) of the non-gateway server ([GW → low collection] in the illustration). 1 (second policy), the collection volume calculation unit 32 calculates the collection volume of the communication server 116, which accommodates a small number of users, to be larger than the collection volumes of the other servers (in the illustration, [small US → large collection]). In accordance with the illustration (second policy), the collection volume calculation unit 32 calculates the collection volume of the communication server 114, which accommodates a large number of users, to be smaller than the collection volumes of the other servers (in the illustration, [large US → small collection]).

[0024] Fig. 4 is a network diagram showing a second example of the topology stored in the topology storage unit 31. Fig. 4 shows a normal state in which no abnormality signs are detected in any of the communication servers 121 to 126. The topology in Fig. 4 shows a network system in which the communication server 10 in Fig. 1 is connected to six communication servers 121 to 126. In this topology, all communication servers have the same processing load under normal conditions, and the collection amount calculation unit 32 has calculated the collection amount as "low collection."

[0025] FIG. 5 is a network diagram in which the collection volume calculated by the collection volume calculation unit 32 is added to the second example in FIG. 4 . Assume that the analysis server 20 detects an abnormality symptom in the communication server 125. Hereinafter, the communication server 125 is referred to as the "detection server." Furthermore, the communication servers 121, 124, and 126 located near the detection server (zero hops or less from the detection server) are referred to as "nearby servers." Furthermore, the communication server 123 located far from the detection server (two hops or more from the detection server) is referred to as the "distant server." The collection volume calculation unit 32 increases the collection volume for the detection server and its nearby servers compared to normal in order to improve detection accuracy ([detection → high collection] or [nearby → high collection]). For the distant servers, the collection volume calculation unit 32 reduces the collection volume compared to normal in order to reduce the analysis load on the analysis server 20 ([distant → minimal collection]).

[0026] FIG. 6 is a sequence diagram showing an overview of the operation of the system call collection system 100, assuming the topologies of FIGS. 4 and 5. In addition to the analysis server 20 and the maintenance server 30, FIG. 6 illustrates the following communication servers 121-126: the detection server 125; the nearby server 121; the distant server 123; and the other server 122. Under normal circumstances, each of the communication servers 121, 122, 123, and 125 collects a small amount of system call information (S11A, S11B, S11C, and S11D) and notifies the analysis server 20 of the collection results (S12A, S12B, S12C, and S12D). As described in FIG. 5, the communication server 125 notifies the analysis server 20 of unnatural system call information that may lead to the detection of an abnormality (S12D).

[0027] Based on the system call information notified from each communication server, the analysis server 20 notifies the maintenance server 30 of the analysis result that "communication server 125 = detection server" (S13). The collection volume calculation unit 32 of the maintenance server 30 receives the notification of S13 and executes a collection change process to increase or decrease the collection volume of each communication server (S21), as explained in Fig. 5. The condition setting unit 33 notifies the analysis server 20 of an instruction to change the collection conditions according to the collection volume of each communication server changed in S21 (S22).

[0028] Upon receiving the notification in S22, the analysis server 20 notifies each communication server of an instruction to change the collection conditions according to the network topology of each communication server, as follows: ・Notify the detection server (communication server 125) that the collection volume will be increased from normal (S23D, [Detection → Increased Collection] in FIG. 5). As a result, the communication server 125 increases the collection volume (S31D). ・Notify the nearby server (communication server 121) that the collection volume will be increased from normal (S23A, [Nearby → Increased Collection] in FIG. 5). As a result, the communication server 121 increases the collection volume (S31A). ・Notify the distant server (communication server 123) that the collection volume will be reduced from normal (S23C, [Distant → Minimal Collection] in FIG. 5). As a result, the communication server 123 reduces the collection volume (S31C). The other servers (communication server 122) have not been notified of the instruction to change the collection conditions, and therefore collect a small amount of system call information (S31B), similar to the normal collection amount in S11B.

[0029] The analysis server 20 performs an analysis to detect abnormal signs based on the system call information notified by each communication server (S32A, S32B, S32C, S32D). Here, since the amount of system call information for the detection server and nearby servers is greater than normal, more accurate analysis is possible. As in S13, the analysis server 20 notifies the maintenance server 30 of the analysis results of the system call information notified in S32A to S32D (S33).

[0030] 7 is a flowchart showing the operation of the maintenance server 30. The maintenance server 30 acquires network topology information from the topology collection unit 12 or an administrator, and stores it in the topology storage unit 31 (S101). The collection amount calculation unit 32 calculates the amount of system call information collected by each communication server 10 under normal conditions, and the condition setting unit 33 transmits the system call collection settings to each communication server 10 (S102).

[0031] Here, the collection amount calculation unit 32 determines whether or not there is a communication server 10 showing an abnormal symptom based on the analysis result of the analysis server 20 (S103). If the answer is Yes in S103, the collection amount calculation unit 32 changes the amount of system call information collected by each communication server 10, as in the following example described in Figure 5 (S104). - Increase the amount of information collected by the detection server and nearby servers. - Decrease the amount of information collected by distant servers.

[0032] Then, the collection amount calculation unit 32 determines whether the abnormality of the communication server 10 showing the abnormal symptom has been recovered or not based on the analysis result of the analysis server 20 (S105). If the answer is Yes in S105, the collection amount calculation unit 32 returns the collection amount of system call information in each communication server to the normal collection amount calculated in S102 (S106).

[0033] FIG. 8 is a hardware configuration diagram of each device in the system call collection system 100. Each device (communication server 10, analysis server 20, maintenance server 30) in the system call collection system 100 is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, HDD 904, communication I / F 905, input / output I / F 906, and media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (system call collection program) loaded into RAM 902. This program (also called an application, or an app for short) can be distributed via a communication line or recorded on a recording medium 917 such as a USB memory stick.

[0034] [Effect] The system call collection system 100 of the present invention is characterized by having each communication server 10 that constitutes a network system, and a maintenance server 30 that changes the amount of system call information that each communication server 10 collects from itself based on the magnitude relationship of the processing load according to the network topology of the network system.

[0035] As a result, even when multiple communication servers cooperate to provide a network service, the system call collection system 100 can set the amount of system call information to be collected taking into consideration the network topology situation of each communication server. For example, the system call collection system 100 can set an individual collection amount that matches the system call information collection capacity of each communication server, such as reducing the collection amount for a gateway server with a high traffic volume and processing load.

[0036] Therefore, by mixing communication servers with a larger collection volume and communication servers with a smaller collection volume, the system call collection system 100 can reduce the processing load of system call information used for anomaly detection in a network where multiple communication servers cooperate. Furthermore, the system call collection system 100 can maintain a high amount of information collection for anomaly sign detection across the entire network, rather than uniformly reducing the collection volume from all communication servers, thereby improving detection accuracy.

[0037] The present invention is characterized in that the system call collection system 100 further includes an analysis server 20 that analyzes the system call information collected by each communication server 10, and when the analysis server 20 analyzes that each communication server 10 is in normal operation, the maintenance server 30 determines the processing load according to the network topology based on the position of each communication server 10 according to the network topology or the traffic volume according to the network topology of each communication server 10.

[0038] As a result, the system call collection system 100 can reduce the load of analysis processing on the analysis server 20 during normal times by narrowing down the collection conditions for system call information.

[0039] The present invention is characterized in that when the analysis server 20 detects signs of an abnormality in a first server among the communication servers 10, the maintenance server 30 increases the amount of data collected in the first server and a second server which is a nearby server including a server that is a first predetermined number of hops or less from the first server, and decreases the amount of data collected in the third server which is a distant server including a server that is a second predetermined number of hops or more from the first server.

[0040] As a result, when the analysis server 20 detects a suspected failure or abnormality, the system call collection system 100 increases the amount of data collected at the suspected location and its vicinity, while reducing the amount of data collected at other locations, enabling a more focused analysis by collecting information on locations that require analysis. For example, in locations where the amount of data collected is increased, the accuracy of abnormality detection can be improved or further abnormality symptoms can be detected. On the other hand, in locations where the amount of data collected is reduced, the processing load on the maintenance server 30 can be reduced.

[0041] REFERENCE SIGNS LIST 10 Communication server 10A Application layer 10V Virtualization infrastructure layer 11 Application 12 Topology collection unit 13 Collection control unit 14 Kernel 15 System call collection unit 20 Analysis server 30 Maintenance server 31 Topology storage unit 32 Collection amount calculation unit 33 Condition setting unit 100 System call collection system 121 Communication server (second server) 123 Communication server (third server) 125 Communication server (first server)

Claims

1. A system call collection system comprising: communication servers that make up a network system; and a maintenance server that changes the amount of system call information collected by each communication server based on the magnitude of the processing load according to the network topology of the network system.

2. The system call collection system according to claim 1, further comprising an analysis server that analyzes the system call information collected by each of the communication servers, and when the analysis server analyzes that each of the communication servers is operating normally, the maintenance server determines the processing load according to the network topology based on the location of each of the communication servers according to the network topology or the traffic volume of each of the communication servers according to the network topology.

3. The system call collection system described in claim 2, characterized in that when the analysis server detects signs of an abnormality in a first server among the communication servers, the maintenance server increases the collection amount in the first server and a second server which is a nearby server including a server that is a first predetermined number of hops or less from the first server, and decreases the collection amount in a third server which is a distant server including a server that is a second predetermined number of hops or more from the first server.

4. A system call collection method, comprising: a system call collection system having communication servers that constitute a network system; and a maintenance server; wherein the maintenance server executes a process to change the amount of system call information collected by each communication server based on the magnitude of the processing load according to the network topology of the network system.

Images