System call collection system and system call collection method

Abstract

Each communication server (10) of a system call collection system (100) is provided with a system call collection unit (15) that collects system calls according to a predetermined collection condition. An analysis server (20) is provided with an abnormality sign detection unit (21) that detects a sign of abnormality in a communication server (10). A maintenance server (30) is provided with: an equivalent server extraction unit (31) for extracting an other communication server (10) having a configuration equivalent to that of the communication server (10) in which a sign of abnormality is detected; and a condition setting unit (32) for changing a predetermined collection condition so as to increase the collection amount of system calls for the communication server (10) in which a sign of abnormality is detected and a communication server (10) having the equivalent configuration.

Description

System call collection system and system call collection method

[0001] The present invention relates to a system call collection system and a system call collection method.

[0002] In network systems such as the 5th Generation Core network (5GC), various network functions are defined as network functions (NFs), and a wide variety of communication services can be provided by combining NFs. Virtualized NF (VNF), which realizes NFs as containers, a type of virtualization technology, has also been proposed.

[0003] In order to operate a network system normally and stably, it is necessary to detect signs of abnormalities or failures in the servers that make up the network system. Examples of such detection technologies are as follows: Patent Document 1 describes the use of statistical information on the issuance of system calls by a host OS (Operating System). Non-Patent Document 1 describes an EDR (Endpoint Detection and Response) product that detects signs of abnormalities by monitoring statistical information on system calls.

[0004] JP 2011-258019 A

[0005] Falco, "The Falco Project," [online], [Retrieved April 1, 2024], Internet <URL: https: / / falco.org / docs / >

[0006] Conventional security tools such as those described in Patent Document 1 and Non-Patent Document 1 detect abnormal symptoms in a single server. On the other hand, in a network system, multiple communication servers operate independently or in cooperation with each other. In this case, abnormal symptoms may occur simultaneously or spread across multiple servers. For example, a server may be infected with malware that has the same startup conditions or an incubation period set with the same date, or a worm that spreads copies of a program that performs malicious activities over a network, causing the server to behave abnormally. Until now, it has been difficult to detect abnormalities and their symptoms that occur simultaneously or spread across multiple servers.

[0007] Therefore, an object of the present invention is to improve the accuracy of anomaly detection for a server equivalent to a server in which an abnormality symptom has been detected, but in which an abnormality symptom has not yet been detected.

[0008] In order to solve the above problems, the system call collection system of the present invention comprises the following means: The present invention provides a system call collection system comprising communication servers constituting a network system, an analysis server that analyzes system calls of each of the communication servers, and a maintenance server communicatively connected to the analysis server, wherein each of the communication servers comprises: a system call collection unit that collects the system calls in accordance with predetermined collection conditions related to system call collection, the analysis server comprises: an abnormality sign detection unit that acquires information on the system calls from each of the communication servers and detects signs of abnormality in the communication servers, and the maintenance server comprises: an equivalent server extraction unit that acquires information on a communication server in which an abnormality sign has been detected and extracts other communication servers having an equivalent configuration to the detected communication server, and a condition setting unit that changes the predetermined collection conditions so as to increase the amount of system calls collected for the communication server in which the abnormality sign has been detected and the extracted communication servers having an equivalent configuration.

[0009] According to the present invention, it is possible to improve the accuracy of anomaly detection for a server that is equivalent to a server in which an abnormality symptom has been detected but in which an abnormality symptom has not yet been detected.

[0010] FIG. 1 is a diagram illustrating an example of a network configuration of a communication server that is a target for detecting abnormal signs in a system call collection system according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an overall configuration of a system call collection system according to an embodiment of the present invention. FIG. 3 is a diagram illustrating an example of a data configuration of server classification information according to an embodiment of the present invention. FIG. 4 is a diagram for explaining a peer server extraction process according to an embodiment of the present invention. FIG. 5 is a sequence diagram showing the flow of processing in the system call collection system according to an embodiment of the present invention. FIG. 6 is a diagram illustrating an overall configuration of a system call collection system according to a modified example of the present embodiment. FIG. 7 is a diagram for explaining a peer server extraction process after satisfying predetermined selection conditions according to the present embodiment. FIG. 8 is a diagram illustrating the hardware configuration of each device in the system call collection system according to the present embodiment.

[0011] <Overview> First, an overview of a system call collection system 100 (see FIG. 2) according to this embodiment will be described. Fig. 1 is a diagram illustrating an example of a network configuration of a communication server that is a target for detecting abnormal signs in the system call collection system 100 according to this embodiment.

[0012] As shown in FIG. 1 , the network is composed of multiple communication servers 10. As each communication server 10 undergoes maintenance and management by a maintenance server 30 (described later), the versions of the application layer (main application, library, process), virtualization infrastructure layer, OS / hardware layer, etc., change. A library is a collection of program components, each of which is a program with a specific function, stored in a file so that it can be called and used by other programs. Here, it is noted that if there are communication servers 10 among the multiple communication servers 10 that have the same current system configuration (version, etc.), these communication servers 10 are likely to experience the same abnormality. The possibility of the same abnormality occurring can be attributed to, for example, the aging of the same components or the existence of common vulnerabilities to malware.

[0013] Therefore, in the system call collection system 100 according to this embodiment, when an abnormal symptom is detected as a result of monitoring the system calls of a certain communication server 10, the amount of collected information about system calls is increased for other communication servers 10 that have the same (common) configuration (version, etc.) as the communication server 10. In the example shown in FIG. 1 , if the applications of the communication servers 10 (#02, #03, #04) are products of Company X and the library version is "Version 2.1," and an abnormality or an abnormal symptom (hereinafter, sometimes referred to as "abnormal symptom, etc.") is detected by the collected system calls (denoted as "SC" in each figure) in one of the communication servers 10 (e.g., communication server #05), collection is also strengthened for other communication servers 10 (communication servers #02, #03) that have the same configuration (version, etc.) and in which no abnormal symptom, etc. has yet been detected. In other words, the amount of collected information about system calls is increased. As a result, the system call collection system 100 can strengthen collection of system call information even for communication servers 10 in which abnormal symptoms or the like have not yet been detected, thereby improving the accuracy of detection of abnormal symptoms or the like.

[0014] <Present Embodiment> An embodiment of the present invention will be described in detail below with reference to the drawings. Fig. 2 is a diagram showing the overall configuration of a system call collection system 100 according to this embodiment. In the system call collection system 100, a plurality of communication servers 10, an analysis server 20, and a maintenance server 30 are connected via a network. A network system such as that shown in Fig. 1 is configured between the communication servers 10 that relay data. The analysis server 20 analyzes system call information (system call information) collected by each communication server 10 to detect the occurrence of an abnormality (failure) or signs of an abnormality (such as an abnormal sign) in the communication server 10.

[0015] The maintenance server 30 stores the current maintenance status (version, etc.) of each configuration of each communication server 10, and uses server classification information 300 (see FIG. 3, described in detail later) for classifying the communication servers 10 to extract other communication servers 10 having the same configuration (version, etc.) as the communication server 10 in which an abnormal symptom, etc. has been detected. The maintenance server 30 then increases the amount of collected system call information between the communication server 10 in which an abnormal symptom, etc. has been detected and the extracted other communication servers 10. The communication server 10, analysis server 20, and maintenance server 30 will be described in detail below.

[0016] <Communication Server> The communication server 10 is realized using hardware resources such as a CPU and a storage device, and includes a virtualization infrastructure layer 10V that provides OS functions and an application layer 10A that runs on the virtualization infrastructure layer 10V. The application layer 10A includes an application 11 for providing services using a VNF or the like, and a collection control unit 12 that controls the system call collection unit 15. The collection control unit 12 instructs the system call collection unit 15 to set up system call collection in accordance with predetermined collection conditions (type, frequency, capacity, etc. of collection) notified from the maintenance server 30 via the analysis server 20. The collection control unit 12 also transmits the system calls collected by the system call collection unit 15 to the analysis server 20.

[0017] The virtualization infrastructure layer 10V has a kernel 14, which is a core function of the OS, and a system call collection unit 15 that collects system calls from the kernel 14. The system call collection unit 15 collects (copies) system calls that the kernel 14 receives from applications 11 (e.g., VNFs) and outputs them to a collection control unit 12 in the application layer 10A. Note that when the OS is Linux (registered trademark), the system call collection unit 15 can be implemented in the kernel 14 using an extended Berkeley Packet Filter (eBPF).

[0018] <<Maintenance Server>> The maintenance server 30 includes a peer server extraction unit 31 , a condition setting unit 32 , and server classification information 300 .

[0019] When the equivalent server extraction unit 31 receives notification of the analysis results of the system calls of each communication server 10 from the analysis server 20, it extracts the communication server 10 in which abnormal signs, etc. have been detected and other communication servers 10 that have equivalent configurations (common versions, etc.) based on the server classification information 300 (Figure 3) for classifying the communication servers 10.

[0020] 3 is a diagram showing an example of the data configuration of server classification information 300 according to this embodiment. The server classification information 300 is information for classifying the communication servers 10 based on the current maintenance status (version, etc.) of each communication server 10. The server classification information 300 stores information on the current maintenance status (version, etc.) of the configuration of each communication server 10, specifically, the application layer 10A (main application, library, process), virtualization infrastructure layer 10V, and OS / hardware layer (not shown in FIG. 2) of that communication server 10.

[0021] For example, as shown in FIG. 3 , the server classification information 300 stores the following information: The manufacturer of the application installed on the communication server 10 (#01) is "Company P," the version of the application itself is "Version 2.0," and the version of the application's library is "Version 2.0." The version of the virtualization infrastructure configuration of the communication server 10 (#01) is "Virtualization 21." The version of the hardware resource configuration of the communication server 10 (#01) is "Resource 02." The manufacturer of the application installed on the communication server 10 (#02) is "Company X," the version of the application itself is "Version 3.1," and the version of the application's library is "Version 2.1." The version of the virtualization infrastructure configuration of the communication server 10 (#02) is "Virtualization 31." The version of the hardware resource configuration of the communication server 10 (#02) is "Resource 02." Similarly, the current maintenance status (e.g., version) of the configuration of each communication server 10 is stored in the server classification information 300.

[0022] The server classification information 300 may store, as more detailed information, the version of the OS corresponding to the virtualization infrastructure configuration of each communication server 10. Furthermore, as more detailed information about the hardware resource configuration, the manufacturer, model name, version, etc. of the CPU, memory, accelerator, etc. may be stored.

[0023] When the equivalent server extraction unit 31 receives an analysis result notification from the analysis server 20, including information indicating that an abnormal symptom has been detected for one of the communication servers 10, the equivalent server extraction unit 31 refers to the server classification information 300 ( FIG. 3 ) and extracts communication servers 10 equivalent to the communication server 10 that detected the abnormal symptom, based on a predetermined logic for determining equivalence. For example, if the predetermined logic is to determine that communication servers 10 that have a common application library (e.g., the same version) are equivalent, the equivalent server extraction unit 31 refers to the server classification information 300 and determines that communication servers 10 (#02, #03, #05) that have the same library version are equivalent communication servers 10. In addition, when the equivalent server extraction unit 31 adopts a predetermined logic of determining that communication servers 10 with a common version of the virtualization infrastructure configuration (for example, the same version) are equivalent, it refers to the server classification information 300 (Figure 3) and determines, for example, that communication servers 10 (#02, #03) with a virtualization infrastructure configuration version of "Virtualization 31" are equivalent communication servers 10.

[0024] A more specific explanation will be given. For example, as indicated by reference numeral 401 in FIG. 4 , assume that the application manufacturer of the communication servers 10 (#02, #03, #05) is "Company X" and the library version is "Version 2.1." Furthermore, assume that an abnormality symptom or the like is detected in the communication server 10 (#05) as indicated by reference numeral 402 in FIG. 4 . In this case, when the equivalent server extraction unit 31 employs, as the predetermined logic, logic for determining that communication servers 10 having the same application library are equivalent, it refers to the server classification information 300 ( FIG. 3 ) and determines that the communication servers 10 (#02, #03) whose library version is the same as that of the communication server 10 (#05), "Version 2.1," are equivalent communication servers 10.

[0025] The equivalent server extraction unit 31 may determine equivalence based on a predetermined logic, or may select an equivalence determination logic appropriate to the abnormal symptom indicated in the analysis result notification. For example, if the system call analysis result indicates an abnormal symptom caused by an application library, the equivalent server extraction unit 31 may determine equivalence based on the version of the application library. If the abnormal symptom is caused by an abnormal symptom related to the virtualization platform, the equivalent server extraction unit 31 may determine equivalence based on the version of the virtualization platform configuration. When determining equivalence based on versions, the equivalent server extraction unit 31 may treat versions such as "Version 2.1," "Version 2.2," "Version 2.3," etc. as common versions in the same "Version 2" group and determine equivalence. In this way, the granularity of each version used to determine equivalence may be preset.

[0026] The equivalent server extraction unit 31 outputs to the condition setting unit 32 information on the communication server 10 that detected the abnormality sign or the like and the communication server 10 that was determined to be equivalent to the communication server 10 .

[0027] The condition setting unit 32 generates information (collection condition change instruction) that instructs changing the collection conditions so as to increase the amount of collected system call information for the communication server 10 that detected an abnormality symptom or the like and the communication server 10 that is determined to be equivalent to the communication server 10. This collection condition change instruction includes at least the identification information of the communication server 10 for which the amount of collected system call information is to be increased.

[0028] Furthermore, this collection condition change instruction may include condition setting information, which is a specific instruction regarding the collection conditions for increasing the amount of collected system call information. Specifically, the following information may be included in association with each communication server 10: - For a communication server 10 for which an increased amount of collected system call information is to be collected, the condition setting is changed to increase the number of applications (e.g., VNFs) to be collected. - For a communication server 10 for which an increased amount of collected system call information is to be collected, the condition setting is changed to increase the number of system call types (e.g., function names) to be collected. - For a communication server 10 for which an increased amount of collected system call information is to be collected, the frequency of collection processing is increased. For example, the condition setting is changed to increase the frequency of collection processing startup, the collection time per collection processing, or the collection capacity per collection processing, thereby increasing the collection frequency.

[0029] The condition setting unit 32 transmits a collection condition change instruction, including identification information of the communication server 10 for which the amount of collected system call information is to be increased, to the analysis server 20. The condition setting unit 32 may be configured to be provided in either the maintenance server 30 or the analysis server 20. When the condition setting unit 32 is provided in the analysis server 20, the equivalent server extraction unit 31 of the maintenance server 30 transmits a collection condition change instruction, including identification information of the communication server 10 for which the amount of collected system call information is to be increased, to the analysis server 20.

[0030] <Analysis Server> The analysis server 20 acquires and analyzes system call information from each communication server 10 to detect abnormalities and signs of abnormalities (such as abnormal signs) in the communication servers 10. Furthermore, based on a collection condition change instruction acquired from the maintenance server 30, the analysis server 20 identifies a communication server 10 for which the amount of system call information collected is to be increased, and sets the changed collection condition setting information in the target communication server 10. This analysis server 20 includes an abnormal sign detection unit 21 and a condition setting processing unit 22.

[0031] The abnormality sign detection unit 21 detects abnormalities or signs of abnormalities in the communication server 10 based on a predetermined analysis logic, for example by detecting changes from normal times. When the abnormality sign detection unit 21 detects an abnormality sign or the like, it transmits an analysis result notification including identification information of the communication server 10 to the maintenance server 30.

[0032] The condition setting processing unit 22 determines the communication servers 10 for which the amount of collected system call information is to be increased based on the identification information of the communication servers 10 for which the amount of collected system call information is to be increased, which is included in the collection condition change instruction received from the maintenance server 30. The condition setting processing unit 22 also generates collection condition change setting information to which condition setting information corresponding to each of the target communication servers 10 is attached. Note that, if the collection condition change instruction received from the maintenance server 30 includes condition setting information corresponding to each of the target communication servers 10, the condition setting processing unit 22 attaches the information to the collection condition change setting information. On the other hand, if the collection condition change instruction does not include condition setting information for the target communication server 10, the condition setting processing unit 22 sets collection conditions for increasing the amount of collected system call information, generates condition setting information, and attaches it to the collection condition change setting information.

[0033] The condition setting processing unit 22 changes the collection conditions of each communication server 10 by transmitting the generated collection condition change setting information to the communication server 10 to be targeted.

[0034] <Processing of System Call Collection System> Next, a description will be given of the flow of processing executed by the system call collection system 100. Fig. 5 is a sequence diagram showing the flow of processing of the system call collection system 100, using the topology shown in Fig. 4 as an example.

[0035] First, under normal circumstances, each communication server 10 (#01, #02, #03, #04, #05, #06) collects a small amount of system call information (S11a, S11b, S11c, S11d, S11e, S11f) and notifies the analysis server 20 of the collection results (S12a, S12b, S12c, S12d, S12e, S12f). As explained in Fig. 4, the communication server 10 (#05) notifies unnatural system call information that may lead to the detection of an abnormality symptom (S12e).

[0036] The analysis server 20 analyzes the system call information of the communication server 10 (#05) and detects abnormal signs, etc. Then, it transmits an analysis result notification including the fact that abnormal signs, etc. have been detected in the communication server 10 (#05) to the maintenance server 30 (S13).

[0037] When the maintenance server 30 receives the analysis result notification from the analysis server 20, it extracts other communication servers 10 (#02, #03) having the same configuration (version, etc.) as the communication server 10 in which an abnormality symptom or the like has been detected, based on the server classification information 300 (FIG. 3) for classifying the communication servers 10 (S14: Extract equivalent servers). Here, it is assumed that the equivalent server extraction unit 31 of the maintenance server 30 is set with a predetermined logic for determining equivalence, which is a logic for determining that communication servers 10 having a common application library (same version) are equivalent.

[0038] The maintenance server 30 generates a collection condition change instruction including identification information of the communication server 10 (#5) that detected the abnormality signs and other communication servers 10 (#02, #03) that have the same configuration (version, etc.) as the communication server 10 (#5), and sends it to the analysis server 20 (S15).

[0039] Next, the analysis server 20 determines the communication servers 10 for which the amount of system call information collected will be increased based on the identification information of the communication servers 10 for which the amount of system call information collected is increased, which is included in the collection condition change instruction received from the maintenance server 30. Here, the analysis server 20 determines the communication servers 10 (#02, #03, #05) as the communication servers 10 for which the amount of system call information collected will be increased. The analysis server 20 then transmits collection condition change setting information to the determined communication servers 10 (#02, #03, #05) (S16b, S16c, S16e). As a result, the amount of system call information collected by the communication servers 10 (#02, #03, #05) is set to be large (S17b, S17c, S17e).

[0040] The analysis server 20 then receives a large amount of collected system call information from the communication servers 10 (#02, #03, #05) (S18b, S18c, S18e). The analysis server 20 also receives a smaller amount of collected system call information from the other communication servers 10 (#01, #04, #06) (S18a, S18d, S18f). Based on this system call information, the analysis server 20 performs analysis to detect abnormality signs, etc. The analysis server 20 then transmits a notification of the analysis results to the maintenance server 30 (S19).

[0041] As a result, the system call collection system 100 is equivalent to a server in which an abnormal symptom or the like has been detected, and the accuracy of anomaly detection can be improved for servers in which no abnormal symptom has been detected, just like for servers in which an abnormal symptom has been detected. Therefore, the system as a whole can analyze abnormal symptoms with higher accuracy.

[0042] <Modification of this Embodiment> Next, a modification of the system call collection system 100 ( FIG. 2 ) according to this embodiment will be described. In the system call collection system 100 ( FIG. 2 ) according to this embodiment, when an abnormal symptom or the like is detected in a certain communication server 10, the amount of collected system call information is increased (unconditionally) for communication servers 10 having the same configuration (version, etc.) as the communication server 10. In contrast, in a system call collection system 100A (see FIG. 6 , described later) according to a modification of this embodiment, from among communication servers 10 extracted as having the same configuration (version, etc.) as the communication server 10 in which an abnormal symptom or the like has been detected, communication servers 10 that satisfy predetermined selection conditions are selected as communication servers 10 for which the amount of collected system call information is to be increased.

[0043] The predetermined selection condition may take into consideration, for example, the positional relationship in the network topology between the communication server 10 in which an abnormal symptom or the like has been detected and other communication servers 10. If a communication server 10 equivalent to the communication server 10 in which an abnormal symptom or the like has been detected is located near the communication server 10 in which the abnormal symptom or the like has been detected, it is selected as a target for increasing the amount of system call information collected, but if it is located far away, it is not selected. Furthermore, a communication server 10 directly connected on the network to the communication server 10 in which the abnormal symptom or the like has been detected is not selected. In this way, when the system call collection system 100A detects an abnormal symptom or the like in a certain communication server 10, it can strengthen the collection condition by limiting it to only that communication server 10 and communication servers 10 in the vicinity of that communication server 10. Therefore, the system call collection system 100A can improve the accuracy of detecting abnormal symptoms or the like while suppressing an increase in the amount of system call information collected throughout the system.

[0044] Figure 6 is a diagram showing the overall configuration of a system call collection system 100A according to a modified example of this embodiment. Components having the same functions as those in the system call collection system 100 shown in Figure 2 are given the same names and reference numerals, and descriptions thereof will be omitted. The system call collection system 100A shown in Figure 6 differs from the system call collection system 100 (Figure 2) in that the application layer 10A of each communication server 10 includes a topology collection unit 13, and the maintenance server 30 includes a topology storage unit 330 and an equivalent server extraction unit 31A instead of the equivalent server extraction unit 31 (Figure 2).

[0045] The topology collection unit 13 of the communication server 10 collects the topology related to its own communication server 10. The topology collection unit 13 transmits the collected information on the topology to the maintenance server 30.

[0046] The topology storage unit 330 of the maintenance server 30 stores the topology of the network system formed by the communication servers 10. The topology storage unit 330 stores topology information notified from the topology collection unit 13 of each communication server 10 or topology information input by an administrator or the like. The topology is arrangement information of the communication server 10 that indicates how the communication server 10 is connected to other devices.

[0047] When the equivalent server extraction unit 31A receives an analysis result notification from the analysis server 20, which includes information indicating that an abnormal symptom or the like has been detected in one of the communication servers 10, the equivalent server extraction unit 31A first refers to the server classification information 300 ( FIG. 3 ) and extracts communication servers 10 equivalent to the communication server 10 that detected the abnormal symptom or the like, based on a predetermined equivalence determination logic. The equivalent server extraction unit 31A selects, from among the communication servers 10 extracted as having a configuration equivalent to the communication server 10 in which the abnormal symptom or the like has been detected (same version, etc.), communication servers 10 that satisfy predetermined selection conditions as communication servers 10 for which the amount of system call information collected is to be increased.

[0048] The specified selection condition is, for example, a condition that takes into consideration the positional relationship in the network topology between the communication server 10 in which an abnormal symptom or the like was detected and other communication servers 10, and if a communication server 10 equivalent to the communication server 10 in which an abnormal symptom or the like was detected is located near the communication server 10 in which the abnormal symptom or the like was detected, it is selected as a target for increasing the amount of system call information collected, but if it is located far away (not nearby), it is not selected.

[0049] A more specific explanation will be given below. For example, as indicated by reference numeral 701 in Fig. 7 , assume that the application manufacturer of the communication servers 10 (#02, #03, #05) is "Company X" and the library version is "Version 2.1." When the equivalent server extraction unit 31A employs, as the predetermined logic, logic for determining that communication servers 10 having the same application library are equivalent, the equivalent server extraction unit 31A refers to the server classification information 300 (Fig. 3) and extracts the communication server 10 (#05) in which an abnormality symptom or the like has been detected and the communication servers 10 (#02, #03) having the same library version, "Version 2.1," as equivalent communication servers 10.

[0050] Furthermore, the equivalent server extraction unit 31A refers to the topology information stored in the topology storage unit 330 and selects, from the extracted equivalent communication servers 10, the communication server 10 (#02) that is a predetermined number of hops (e.g., "1") or less from the communication server 10 (#05) in which an abnormal symptom or the like has been detected, as a communication server 10 for which the amount of system call information collected is to be increased. In other words, the equivalent server extraction unit 31A selects the communication server 10 (#5) in which an abnormal symptom or the like has been detected and its neighboring equivalent server, the communication server 10 (#2), as communication servers 10 for which the amount of system call information collected is to be increased. Note that the communication server 10 (#03) is a server equivalent to the communication server 10 (#05) in which an abnormal symptom or the like has been detected, but since the number of hops is "2," which exceeds the predetermined number "1," it is not a neighboring server and is not selected as a communication server 10 for which the amount of system call information collected is to be increased. Although the number of hops has been exemplified as an index for determining the communication server 10 in the vicinity of the communication server 10 in which an abnormality symptom or the like has been detected, other network distances (metrics) such as delay may also be used.

[0051] As another example of a predetermined selection condition, a communication server 10 directly connected on the network may not be selected from either a communication server 10 in which an abnormal symptom or the like has been detected or a communication server 10 extracted as having an equivalent configuration to the communication server 10. For example, assuming infection by a worm or the like that spreads copies of a program that performs fraudulent activities via a network, it is predicted that an abnormality will occur due to infection of a directly connected communication server 10. Therefore, detection of an abnormality due to infection by malware such as a worm is performed on some of the communication servers 10 rather than all of the equivalent target communication servers 10 to prevent excessive load on the entire system.

[0052] For example, as shown by symbol 702 in Figure 7, the equivalent server extraction unit 31A does not select, among the communication servers 10 (#02, #03) extracted as having a configuration equivalent to the communication server 10 in which abnormal symptoms, etc. have been detected, the communication server 10 (#03) that is directly connected to the communication server (#02) having the equivalent configuration as a communication server 10 for which the amount of system call information collected is to be increased.

[0053] The equivalent server extraction unit 31A selects communication servers 10 that satisfy predetermined selection conditions from among the communication servers 10 extracted as having the same configuration (version, etc.) as the communication server 10 in which the abnormal symptom, etc. was detected. Then, the equivalent server extraction unit 31A outputs information on the communication server 10 in which the abnormal symptom, etc. was detected and the communication servers 10 selected as satisfying the predetermined selection conditions to the condition setting unit 32.

[0054] As a result, the system call collection system 100A can improve the accuracy of detecting abnormal signs and the like while suppressing an increase in the amount of collected system call information for the entire system.

[0055] <Hardware Configuration> FIG. 8 is a hardware configuration diagram of each device in the system call collection systems 100 and 100A. Each device (communication server 10, analysis server 20, and maintenance server 30) in the system call collection systems 100 and 100A is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, HDD 904, communication I / F 905, input / output I / F 906, and media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (system call collection program) loaded into RAM 902. This program (also called an application, or an app for short) can be distributed via a communication line or recorded on a recording medium 917 such as a USB memory stick.

[0056] [Effect] The system call collection system of the present invention is a system call collection system 100 comprising each communication server 10 that constitutes a network system, an analysis server 20 that analyzes the system calls of each communication server 10, and a maintenance server 30 that is communicatively connected to the analysis server 20, wherein each communication server 10 comprises: a system call collection unit 15 that collects system calls in accordance with predetermined collection conditions for collecting system calls; the analysis server 20 comprises: an abnormality sign detection unit 21 that acquires system call information from each communication server 10 and detects signs of abnormality in the communication server 10; and the maintenance server 30 comprises: an equivalent server extraction unit 31 that acquires information about a communication server in which a sign of abnormality has been detected and extracts other communication servers that have a configuration equivalent to the detected communication server; and a condition setting unit 32 that changes the predetermined collection conditions so as to increase the amount of system calls collected for the communication server 10 in which a sign of abnormality has been detected and for the extracted communication server 10 with an equivalent configuration.

[0057] As a result, the system call collection system 100 is a communication server having a configuration equivalent to that of a communication server in which signs of an abnormality have been detected, and for servers in which signs of an abnormality have not been detected, the collection conditions can be changed to increase the amount of system calls collected, thereby improving the accuracy of abnormality detection.

[0058] The system call collection system 100 of the present invention is characterized in that the maintenance server 30 is provided with server classification information 300 that stores the current maintenance status of the configuration of each communication server 10, including applications, virtualization infrastructure, and hardware resources, and the equivalent server extraction unit 31 refers to the server classification information 300 and extracts communication servers 10 that have the same maintenance status as the communication server 10 in which signs of an abnormality have been detected, as communication servers 10 with equivalent configurations.

[0059] In this way, by having the maintenance server 30 of the system call collection system 100 equipped with the server classification information 300 (Figure 3), it is possible to extract communication servers 10 with a common maintenance status that are likely to experience an abnormality similar to that of the communication server 10 in which symptoms of an abnormality have been detected, as communication servers 10 with an equivalent configuration.

[0060] The system call collection system 100A of the present invention is characterized in that the maintenance server 30 is equipped with a topology storage unit 330 in which the network topology of the network system is stored, and the equivalent server extraction unit 31A selects, from the extracted communication servers 10 having equivalent configurations, a nearby communication server 10 that satisfies predetermined selection conditions, including the number of hops from the communication server 10 in which signs of abnormality have been detected, being a predetermined number or less, as the communication server 10 that will increase the amount of system calls collected, based on the network topology.

[0061] As a result, the system call collection system 100A can improve the accuracy of detecting signs of abnormalities while suppressing an increase in the amount of collected system call information for the entire system.

[0062] REFERENCE SIGNS LIST 10 Communication server 10A Application layer 10V Virtualization infrastructure layer 11 Application (application) 12 Collection control unit 13 Topology collection unit 14 Kernel 15 System call collection unit 20 Analysis server 21 Abnormal sign detection unit 22 Condition setting processing unit 30 Maintenance server 31, 31A Equivalent server extraction unit 32 Condition setting unit 100, 100A System call collection system 300 Server classification information 330 Topology storage unit

Claims

1. A system call collection system comprising communication servers that constitute a network system, an analysis server that analyzes the system calls of each of the communication servers, and a maintenance server that is communicatively connected to the analysis server, wherein each of the communication servers comprises: a system call collection unit that collects the system calls in accordance with predetermined collection conditions for collecting system calls; the analysis server comprises: an abnormality sign detection unit that acquires information about the system calls from each of the communication servers and detects signs of abnormality in the communication servers; and the maintenance server comprises: an equivalent server extraction unit that acquires information about a communication server in which an abnormality sign has been detected and extracts other communication servers that have an equivalent configuration to the detected communication server; and a condition setting unit that changes the predetermined collection conditions so as to increase the amount of system calls collected for the communication server in which the abnormality sign has been detected and the extracted communication servers with an equivalent configuration.

2. The system call collection system of claim 1, wherein the maintenance server has server classification information that stores the current maintenance status of the configuration of each of the communication servers, including applications, virtualization infrastructure, and hardware resources, and the equivalent server extraction unit references the server classification information and extracts communication servers that have a common maintenance status with the communication server in which the symptom of the abnormality was detected as communication servers with the equivalent configuration.

3. The system call collection system according to claim 1 or claim 2, characterized in that the maintenance server has a topology storage unit in which the network topology of the network system is stored, and the equivalent server extraction unit selects, from the extracted communication servers having equivalent configurations, a nearby communication server that satisfies predetermined selection conditions, including that the number of hops from the communication server in which the symptom of the abnormality is detected is a predetermined number or less, as a communication server that will increase the amount of system calls collected, based on the network topology.

4. A system call collection method for a system call collection system comprising communication servers constituting a network system, an analysis server that analyzes the system calls of each of the communication servers, and a maintenance server that is communicatively connected to the analysis server, wherein each of the communication servers executes a step of collecting the system calls in accordance with predetermined collection conditions for collecting the system calls, the analysis server executes a step of acquiring information about the system calls from each of the communication servers and detecting signs of abnormality in the communication servers, and the maintenance server executes a step of acquiring information about the communication server in which a sign of abnormality has been detected and extracting other communication servers that have an equivalent configuration to the detected communication server, and a step of changing the predetermined collection conditions so as to increase the amount of system calls collected for the communication server in which the sign of abnormality has been detected and the extracted communication server with an equivalent configuration.

Images