Abnormality detection device and program

Abstract

An abnormality detection device (100) is provided with: a profile selection unit (115) that selects a profile describing a feature of a system call issued by a process operating on a computer; and an abnormality detection unit (116) that performs prescribed abnormality handling processing when the system call issued by the process does not match the feature described in the profile. The profile selection unit (115) selects the profile in accordance with one of a process, the user who has started the process, the group to which the user who has started the process belongs, the program of the process, and a combination of two or more of the process, the user who has started the process, the group to which the user who has started the process belongs, and the program of the process.

Description

Anomaly detection device and program

[0001] The present invention relates to an anomaly detection device and a program for detecting abnormal behavior of a system call invoked by a process.

[0002] To minimize the risk of cyberattacks on computer systems, it is necessary to provide the system and its components with the minimum necessary functions and permissions, and to quickly detect and deal with any abnormalities that occur in the system. Secure computing mode (see Non-Patent Document 1) is a technology that restricts the functions and permissions of the Linux OS. This technology allows you to set the system calls that can be called for each process, and if an unset system call is called, the process can be stopped or recorded in a log.

[0003] seccomp, System Calls Manual, [online], Manned.org, [Retrieved May 29, 2024], Internet<URL: https: / / manned.org / seccomp.2>

[0004] By using the technology of Non-Patent Document 1, it is possible to restrict system calls invoked by a process. However, this technology restricts / monitors system calls for each process, which leaves a problem in that it does not allow for flexible configuration of system call detection. For example, it is not possible to configure detection based on the user who started the process. Also, while it is possible to configure whether or not a system call can be invoked, it is not possible to configure detection based on the frequency of invocation, return value, etc. The present invention has been made in light of this background, and aims to enable flexible detection of system calls that exhibit abnormal behavior.

[0005] In order to solve the above-mentioned problems, the anomaly detection device of the present invention comprises a profile selection unit that selects a profile describing the characteristics of a system call invocation of a process running on a computer in accordance with the process, the user who started the process, the group to which the user who started the process belongs, the program of the process, and a combination of two or more of the process, the user who started the process, the group to which the user who started the process belongs, and the program of the process; and an anomaly detection unit that performs predetermined anomaly response processing when the system call invocation of the process does not match the characteristics described in the profile.

[0006] According to the present invention, it is possible to flexibly detect system calls that exhibit abnormal behavior.

[0007] FIG. 1 is a functional block diagram of an anomaly detection device according to a first embodiment. FIG. 2 is a diagram showing the configuration of a profile according to the first embodiment. FIG. 3 is a flowchart of a profile creation process according to the first embodiment. FIG. 4 is a flowchart of an anomaly detection process according to the first embodiment. FIG. 5 is a functional block diagram of an anomaly detection device according to a second embodiment. FIG. 6 is a diagram showing the configuration of a profile stored in a profile database according to the second embodiment. FIG. 7 is a flowchart of a profile creation process according to the second embodiment. FIG. 8 is a flowchart of an anomaly detection process according to the second embodiment. FIG. 9 is an overall configuration diagram of an anomaly detection system according to a third embodiment. FIG. 10 is a hardware configuration diagram showing an example of a computer that realizes the functions of the anomaly detection device according to the above-mentioned embodiments.

[0008] <<Outline of Anomaly Detection Device>> An outline of an anomaly detection device in a mode (embodiment) for carrying out the present invention will be described below. The anomaly detection device is associated with a user and stores a profile including system calls that can be called from a process started by that user. When a process is started, the anomaly detection device monitors the invocation of system calls for the process. If the called system call is included in the profile, the anomaly detection device allows the execution of that system call. When a system call that is not included in the profile is detected, the anomaly detection device performs a predetermined anomaly response process, such as recording the call in a log and allowing it, stopping the process, or returning an error.

[0009] A profile may be associated not only with a user, but also with a group to which the user belongs, a process, or a program. If a process started by a user belonging to a group or a system call invoked by a program process is not included in the profile, the anomaly detection device may perform a predetermined anomaly response process. Note that the relationship between a process and a program when referring to a program process and a program of a process refers to the process as a unit of program execution. In other words, the process loads a program and executes processing.

[0010] Such an anomaly detection device can detect system calls that are not included in profiles associated with users, processes, or programs. The anomaly detection device can also perform predetermined anomaly response actions, such as terminating processes. Such an anomaly detection device can quickly detect and prevent cyberattacks, such as user account takeovers and unauthorized privilege escalation.

[0011] <Configuration of Anomaly Detection Device> Fig. 1 is a functional block diagram of an anomaly detection device 100 according to a first embodiment. The anomaly detection device 100 is a computer and includes a control unit 110, a storage unit 120, and an input / output unit 180. User interface devices such as a display, keyboard, and mouse are connected to the input / output unit 180. The input / output unit 180 may include a communication device, enabling data transmission and reception with other devices. Furthermore, a media drive may be connected to the input / output unit 180, enabling data exchange using a recording medium.

[0012] <<Anomaly Detection Device: Storage Unit>> The storage unit 120 is configured to include storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 stores a system call log 130, a profile database 140, an alert log 150, and a program 128. The program 128 includes a description of processing by functional units included in the control unit 110, which will be described later. Note that the various storage contents of the storage unit 120 may be stored in an external storage device, such as a cloud server, and read as needed.

[0013] <Storage Unit: System Call Log> The system call log 130 records, in association with each other, identification information of the system call, identification information of the process, time, etc., for system calls invoked by processes running on the anomaly detection device 100. The system call log 130 may include identification information of the program of the process, identification information of the user who started it, identification information of the group to which the user belongs, identification information of the effective user, identification information of the process group, argument values, return values, etc.

[0014] <Storage Unit: Profile Database> The profile database 140 stores a profile 141 (see FIG. 2 ) described below in association with the user's identification information. The profile 141 may be stored in association with the identification information of a group to which the user belongs, a process, or a program. The profile 141 describes the characteristics of a system call invocation of a process.

[0015] 2 is a diagram showing the configuration of a profile 141 according to the first embodiment. The profile 141, which describes the characteristics of system call invocations of a process, includes identification information of system calls that are unconditionally permitted to be invoked. The profile 141 in FIG. 2 includes the name of the system call as identification information. The profile 141 may also include the system call number instead of the system call name.

[0016] System calls not included in the profile 141 are not necessarily prohibited (not processed and an error returned). The call may be recorded in a warning log 150 (described later) and then permitted, or the calling process may be stopped, and a predetermined abnormality response process set by the administrator may be executed.

[0017] 1 , the description of the storage unit 120 will be continued. The warning log 150 records the fact that a system call not included in the profile 141 has been called. The warning log 150 records the time, identification information of the system call, identification information of the process that called the system call, identification information of the user that started the process, identification information of the program, argument values ​​and return values, the content of the abnormality response processing (e.g., process stop), and the like.

[0018] <<Anomaly Detection Device: Control Unit>> The control unit 110 is configured to include a CPU (Central Processing Unit) and is provided with a process execution unit 111, a system call detection unit 112, a system call collection unit 113, a profile creation unit 114, a profile selection unit 115, and an anomaly detection unit 116. The process execution unit 111 executes a process of a program specified by a user or a process.

[0019] <<Controller: System Call Detection Unit>> The system call detection unit 112 detects system calls invoked by processes and notifies the system call collection unit 113 (described later) of the detection results as invocation information. The invocation information includes the contents recorded in the alert log 150, such as the time and system call identification information, excluding the contents of the abnormality response processing.

[0020] The system call detection unit 112 is, for example, an extended Berkley Packet Filter (eBPF - Introduction, Tutorials & Community Resources, [online], [Retrieved May 29, 2024], Internet<URL: https: / / ebpf.io / > ) can be used to detect system calls.

[0021] <<Controller: System Call Collection Unit>> The system call collection unit 113 adds the invocation information of the system call notified by the system call detection unit 112 to the warning log 150 and records it.

[0022] <<Control Unit: Profile Creation Unit>> The profile creation unit 114 creates a profile 141 including system calls invoked by processes during normal operation when not subjected to a cyber-attack, and stores the profile in the profile database 140 .

[0023] For example, the profile creation unit 114 extracts from the system call log 130 system calls invoked by a process started by a user to create a profile 141. Next, the profile creation unit 114 associates the profile 141 with the user and stores it in the profile database 140. Note that the number of processes started by a user is not limited to one; for example, the profile 141 may be created by extracting system calls for all processes started by the user within a predetermined period. Furthermore, as a profile of a process, the profile 141 may be created by extracting from the system call log 130 system calls invoked by the process during normal operation. The same applies to a group of processes.

[0024] The profile creation unit 114 may use the sum or product of the profiles 141 of the users belonging to the group as the profile 141 of the user group. The profile creation unit 114 stores this profile 141 in the profile database 140 in association with the group.

[0025] The profile creating unit 114 may extract system calls made by the process to create the process profile 141. The profile creating unit 114 stores this profile 141 in the profile database 140 in association with the process.

[0026] The profile creation unit 114 may extract system calls invoked by the process of the program to create the program profile 141. The profile creation unit 114 stores this profile 141 in the profile database 140 in association with the program.

[0027] <<Control Unit: Profile Selection Unit>> The profile selection unit 115 selects a profile 141 to be referenced when detecting and monitoring a system call invocation of a process. The profile selection unit 115 selects a profile 141 associated with a process. For example, when a user starts a process, the profile selection unit 115 selects a profile 141 associated with the user in the profile database 140. The profile selection unit 115 may also select a profile 141 associated with a group to which the user belongs. When a user starts a process of a program, the profile selection unit 115 may create and select a profile that is the sum or product of a profile 141 associated with the user or a group to which the user belongs and a profile 141 associated with the program.

[0028] Furthermore, when a process is a process of a specific program, the profile selection unit 115 may select the profile 141 associated with the program. The specific program is, for example, a program of a server that provides a network service. When another specific process specifies a program (command) to start a process, the profile selection unit 115 may select the profile 141 associated with the program. The profile selection unit 115 may select the profile 141 according to a combination of two or more of the user who started the process, the group to which the user who started the process belongs, the process, and the program of the process.

[0029] <<Controller: Abnormality Detection Unit>> The abnormality detection unit 116 executes a predetermined abnormality handling process when a system call invoked by a process does not match the description in the profile 141. To explain in more detail, the abnormality detection unit 116 executes a predetermined abnormality handling process when a system call invoked by a process is not included in the profile 141.

[0030] Examples of abnormality handling processing include prohibiting the call (returning an error without executing the system call), recording the call in the warning log 150 and executing the system call, or stopping the called process. If the profile 141 includes a system call, the abnormality detection unit 116 executes (calls) the system call as is. Note that when prohibiting a call, the abnormality detection unit 116 may instruct the system call detection unit 112 to prohibit the call.

[0031] <<Profile Creation Process>> Figure 3 is a flowchart of the profile creation process according to the first embodiment. A profile 141 is associated with a user, a group to which the user belongs, a process, and a program. At the start of the profile creation process, it is assumed that the process launched by the user and the process of the program have already been executed in a safe environment free from cyberattacks. Therefore, the system calls invoked by the process during normal operation are recorded in the system call log 130. The profile creation process will be explained below using the profile 141 of a user (hereinafter referred to as the target user) as an example, but the same applies to programs.

[0032] In step S11, the profile creation unit 114 extracts records of system call invocations of the target user from the system call log 130. More specifically, the profile creation unit 114 extracts records in which the user identification information is the identification information of the target user from the records included in the system call log 130.

[0033] In step S12, the profile creation unit 114 acquires the identification information of the system call in the record extracted in step S11. Note that even if the same system call appears in multiple records, only one identification information of the system call is acquired.

[0034] In step S13, the profile creation unit 114 creates a list of the identification information of the system calls acquired in step S12 as a profile 141. Subsequently, the profile creation unit 114 stores the profile 141 in the profile database 140 in association with the target user.

[0035] <<Abnormality Detection Processing>> Figure 4 is a flowchart of the abnormality detection processing according to the first embodiment. With reference to Figure 4, the processing for detecting an abnormal system call invocation of a process (referred to as the target process) started by a user (hereinafter referred to as the target user) will be described, but the same applies to groups and programs. An abnormal system call invocation is a system call invocation that is not included in the profile 141. The predetermined abnormality response processing is to record the invocation in the alert log 150.

[0036] In step S21, the profile selection unit 115 selects the profile 141 of the target user stored in the profile database 140. In step S22, the anomaly detection unit 116 starts the process of repeating steps S23 to S25 while the target process is running.

[0037] In step S23, the anomaly detection unit 116 detects a system call invocation of the target process. The anomaly detection unit 116 detects the invocation, for example, by monitoring records in the system call log 130. The system call detection unit 112 may notify the anomaly detection unit 116 of the system call invocation, and the system call invocation of the target process may be detected from the notification.

[0038] In step S24, if the system call detected in step S23 is included in the profile 141 selected in step S21 (step S24→YES), the abnormality detection unit 116 returns the process to step S23. If the system call is not included in the profile 141 (step S24→NO), the abnormality detection unit 116 proceeds to step S25. In step S25, the abnormality detection unit 116 records the call in the alert log 150 as a predetermined abnormality response process.

[0039] <Features of the Anomaly Detection Device> The anomaly detection device 100 can detect, for a process started by a user, the invocation of a system call that is not included in the user's profile 141. Furthermore, the anomaly detection device 100 can stop the process or prohibit the invocation of a system call.

[0040] For example, if a user's account is hijacked by an attacker, the attacker is expected to use commands (processes) different from those used by authorized users. In this case, the system calls invoked by the processes are expected to be different from those of authorized users and will be detected by the anomaly detection device 100. In this way, the anomaly detection device 100 makes it possible to quickly detect and prevent cyber attacks such as the hijacking of user accounts and unauthorized privilege escalation.

[0041] The anomaly detection device 100 can also detect system calls that focus not on the user, but on the group or program to which the user belongs. For example, if a service that provides a network service is taken over by a cyber attack, it is likely that the process providing the service will invoke a system call that differs from normal system calls, and this will be detected by the anomaly detection device 100. In this way, the anomaly detection device 100 can quickly detect and prevent cyber attacks on processes that provide network services.

[0042] Second Embodiment The anomaly detection device 100 according to the first embodiment detects invocation of a system call that is not included in the profile 141. Instead of monitoring each individual system call invocation, it is also possible to monitor the feature of the invocation and execute a predetermined anomaly response process if the feature does not match the feature in the profile. The feature as the feature of the system call invocation of a process includes the system call invocation frequency, arguments, return value, identification information of the user who executed the process, identification information of the group to which the user belongs, identification information of the process, etc.

[0043] The call frequency is the call frequency (call interval time) of all system calls or individual system calls. A histogram of the call frequency (number of calls per unit time) can also be used as a feature. If the argument is a file name or file descriptor, the feature will be the file path name or the folder where the file is located. If the argument is related to a device, the feature will be the device type, manufacturer, model number, identification information, etc.

[0044] If the argument is related to a memory area, its address, size, etc. will be the feature. Note that the feature of the argument is a feature for each system call, but it may be a feature for the entire system call. The feature of the return value is also a feature for each system call, but it may be a feature for the entire system call.

[0045] 5 is a functional block diagram of an anomaly detection device 100A according to the second embodiment. Compared to the anomaly detection device 100 according to the first embodiment, the anomaly detection device 100A differs in a profile creation unit 114A, an anomaly detection unit 116A, and a profile database 140A.

[0046] 6 is a diagram showing the configuration of a profile 142 stored in a profile database 140A according to the second embodiment. The profile 142 is stored in association with a user, a group to which the user belongs, a process, or a program.

[0047] The call frequency indicates the call frequency of all system calls (16.5) and the call frequency of each individual system call (write is 3.4). The profile 142 may also include feature values ​​of arguments for each system call and feature values ​​of the identification information of the user who started the process.

[0048] The profile creation unit 114A creates a profile 142 based on the system call invocations of a process during normal operation when not subjected to a cyber-attack, and stores the profile 142 in the profile database 140A. For example, the profile creation unit 114A creates the profile 142 by calculating, for a program process, the overall system call invocation frequency, the invocation frequency of each system call, and feature quantities such as the path name / folder of a file included in an argument.

[0049] The anomaly detection unit 116A monitors the invocation of system calls of a process over a predetermined long period of time and calculates feature quantities over that predetermined long period of time. If these feature quantities do not match the feature quantities in the profile 142, a predetermined anomaly response process is executed. For example, the anomaly detection unit 116A determines that there is no match if the difference between the calculated call frequency and the call frequency in the profile exceeds a predetermined threshold. Furthermore, the anomaly detection unit 116A determines that there is no match if the folder of the file for the argument of the file descriptor is not included in the folder in the profile. Alternatively, the feature quantities may be variables resulting from preprocessing such as principal component analysis on quantitative variables included in the argument.

[0050] <<Profile Creation Processing>> Fig. 7 is a flowchart of the profile creation processing according to the second embodiment. As in Fig. 3, the profile creation processing will be described using the profile 142 of a user (hereinafter referred to as the target user) as an example, but the same applies to a program.

[0051] In step S31, the profile creation unit 114A extracts records of system call invocations of the target user from the system call log 130. In step S32, the profile creation unit 114A calculates feature amounts based on the records of the invocations extracted in step S31.

[0052] In step S33, the profile creation unit 114A creates a profile 142 including the feature amounts calculated in step S32. Subsequently, the profile creation unit 114A associates the profile 142 with the target user and stores it in the profile database 140A.

[0053] <<Abnormality Detection Processing>> Fig. 8 is a flowchart of the abnormality detection processing according to the second embodiment. With reference to Fig. 8, the processing for detecting an abnormal system call invocation of a process (referred to as the target process) started by a user (referred to as the target user hereinafter) will be described. The same applies to groups and programs. An abnormal system call invocation is a system call invocation that does not match the profile 142.

[0054] In step S41, the profile selection unit 115 selects the profile 142 of the target user stored in the profile database 140 A. In step S42, the abnormality detection unit 116 A starts the process of repeating steps S43 to S45 while the target process is running.

[0055] In step S43, the anomaly detection unit 116A monitors the invocation of system calls of processes over a predetermined long period of time and calculates feature quantities for the predetermined long period of time. Note that the predetermined long periods of time may or may not overlap. For example, if the predetermined length is 3, the periods may be 0 to 3, 1 to 4, 2 to 5, or 0 to 3 and 3 to 6.

[0056] In step S44, if the feature amount calculated in step S43 matches the profile 142 selected in step S41 (step S44→YES), the abnormality detection unit 116A returns the process to step S43. If the feature amount does not match the profile 142 (step S44→NO), the abnormality detection unit 116A proceeds to step S45. In step S45, the abnormality detection unit 116A records a call in the warning log 150 as a predetermined abnormality response process.

[0057] <Features of the Anomaly Detection Device> The anomaly detection device 100A determines whether a system call is normal or abnormal and detects an abnormal call based on the feature amount of the system call, rather than using the whitelist (profile 141) of the first embodiment. In cases where the whitelist method has a high incidence of oversights or false positives, this method is expected to be able to detect abnormal calls with higher accuracy and flexibility.

[0058] <<Modification: Anomaly Detection>> In the second embodiment described above, the anomaly detection unit 116A focuses on the difference in the numerical values ​​of the feature amounts and the folder of the file in the argument to determine whether or not there is a match with the profile 142. Instead of such a determination, the anomaly detection unit 116A may determine a match using machine learning technology.

[0059] For example, the profile creation unit 114A creates learning data by calculating feature quantities of system calls of processes during normal operation when not subjected to a cyber-attack. Next, the profile creation unit 114A creates a judgment model, which is a machine learning model, using, for example, unsupervised learning based on this learning data. This judgment model corresponds to the profile 142. The anomaly detection unit 116A detects anomalies using this judgment model (see step S44).

[0060] When using a machine learning technique, the control unit 110 may be configured to include a graphics processing unit (GPU), a neural (network) processing unit (NPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc. The machine learning technique may be a machine learning technique different from unsupervised learning.

[0061] Third Embodiment The anomaly detection units 116 and 116A in the above-described embodiments perform anomaly detection by monitoring system calls of processes running on the anomaly detection devices 100 and 100A. A process running on a computer different from the anomaly detection devices 100 and 100A may also be monitored.

[0062] 9 is a diagram showing the overall configuration of an anomaly detection system 10 according to the third embodiment. The anomaly detection system 10 includes one or more computers 200 on which processes to be monitored run, and an anomaly detection device 100B. The computers 200 and the anomaly detection device 100B are capable of data communication via a communication network.

[0063] The control unit 210 of the computer 200 includes a process execution unit 211 and a system call detection unit 212B. The system call detection unit 212B notifies the anomaly detection device 100B of a detected system call invocation. The system call detection unit 212B also notifies the initiation of a process. The notification content includes the initiation time, process identification information, the user who initiated the process, the program, etc.

[0064] The control unit 110 of the anomaly detection device 100B is similar to that of the anomaly detection device 100, except that it does not include a process execution unit 111 or a system call detection unit 112. The profile selection unit 115 selects a profile 141 corresponding to the started process based on a process start notification sent by the system call detection unit 212B. The profile as a characteristic description of the system call invocation of the process is not limited to the profile 141 (whitelist), and may be a profile 142 including feature quantities.

[0065] In such an anomaly detection system 10, the anomaly detection device 100B can detect anomalies by monitoring system calls made by processes running on one or more computers 200. For example, if the computers 200 are servers that provide network services and services of the same program are running, efficient anomaly detection becomes possible.

[0066] <Other Modifications> Although several embodiments of the present invention have been described above, these embodiments are merely illustrative and do not limit the technical scope of the present invention. The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications thereof are included in the scope and spirit of the invention described in this specification, etc., and are included in the scope of the invention described in the claims and their equivalents.

[0067] <Hardware Configuration> The anomaly detection devices 100, 100A, and 100B according to the above-described embodiments are realized by a computer 900 having a configuration as shown in FIG. 10 , for example. FIG. 10 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the anomaly detection devices 100, 100A, and 100B according to the above-described embodiments. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, an input / output interface 905 (referred to as an input / output I / F (Interface) in FIG. 10 ), a communication interface 906 (referred to as a communication I / F in FIG. 10 ), and a media interface 907 (referred to as a media I / F in FIG. 10 ). The computer 900 may include a hard disk drive (HDD) instead of the SSD 904, or may include an HDD in addition to the SSD 904.

[0068] The CPU 901 operates based on a program stored in the ROM 902 or the SSD 904, and performs control by the control unit 110. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0069] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 via the input / output interface 905, and outputs generated data to the output device 911.

[0070] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (e.g., the computer 200) via a communication network and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0071] The media interface 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads the program from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical Disk), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0072] For example, when the computer 900 functions as the anomaly detection devices 100, 100A, and 100B according to the above-described embodiments, the CPU 901 of the computer 900 executes the program 128 loaded onto the RAM 903 to realize the functions of the anomaly detection devices 100, 100A, and 100B. The CPU 901 reads and executes the program from the recording medium 912. Alternatively, the CPU 901 may read the program from another device via a communication network, or may install and execute the program 128 from the recording medium 912 onto the SSD 904.

[0073] <Effects> The effects of the anomaly detection devices 100, 100A, and 100B will be described below.

[0074] The anomaly detection devices 100, 100A, and 100B according to the above-described embodiments include a profile selection unit 115 that selects a profile 141 or 142, which describes the characteristics of a system call invocation of a process running on a computer, based on the process, the user who started the process, the group to which the user who started the process belongs, the program of the process, or a combination of two or more of the process, the user who started the process, the group to which the user who started the process belongs, and the program of the process.The anomaly detection devices 100, 100A, and 100B also include an anomaly detection unit 116 or 116A that performs a predetermined anomaly response process when the system call invocation of the process does not match the characteristics described in the profile 141 or 142.

[0075] With such anomaly detection devices 100, 100A, and 100B, profiles 141 and 142 are selected according to the process, the user who started the process, the group to which the user belongs, and the program. If a system call invoked by a process does not match profile 141 or 142, the anomaly detection devices 100, 100A, and 100B assume that an abnormal system call has been detected and perform anomaly response processing. This makes it possible to quickly detect and prevent hijacking of processes of users other than authorized users or processes that provide network services.

[0076] The profile 141 according to the embodiment described above includes identification information of a system call that is called by a process. When a system call that is called by a process is not included in the profile 141, the anomaly detection unit 116 performs a predetermined anomaly handling process.

[0077] Such anomaly detection devices 100 and 100B can detect an abnormal system call invocation using a profile 141 in whitelist format.

[0078] The profile 142 according to the embodiment described above includes feature quantities of system calls called by a process. The anomaly detection unit 116A calculates the feature quantities of system calls called by a process, and when the feature quantities do not match the feature quantities of system calls included in the profile 142, performs a predetermined anomaly response process.

[0079] The anomaly detection devices 100A and 100B described above can detect an abnormal system call based on the profile 142, which describes the feature quantities of the system call. This allows for more flexible detection than detection using a whitelist (profile 141).

[0080] 10 Anomaly detection system 100, 100A, 100B Anomaly detection device 112, 212B System call detection unit 113 System call collection unit 114, 114A Profile creation unit 115 Profile selection unit 116, 116A Anomaly detection unit 128 Program 130 System call log 140, 140A Profile database 141, 142 Profile 150 Warning log 200 Computer

Claims

1. An anomaly detection device comprising: a profile selection unit that selects a profile describing the characteristics of a system call invocation of a process running on a computer in accordance with any of the following: the process, the user that started the process, the group to which the user that started the process belongs, the program of the process, and a combination of two or more of the process, the user that started the process, the group to which the user that started the process belongs, and the program of the process; and an anomaly detection unit that performs predetermined anomaly response processing when the system call invocation of the process does not match the characteristics described in the profile.

2. The anomaly detection device described in claim 1, wherein the profile includes identification information of a system call called by the process, and the anomaly detection unit performs the specified anomaly response processing when the system call called by the process is not included in the profile.

3. The anomaly detection device according to claim 1, wherein the profile includes characteristic quantities of system calls called by the process, and the anomaly detection unit calculates the characteristic quantities of the system calls called by the process, and performs the specified anomaly response processing when the characteristic quantities do not match the characteristic quantities of the system calls included in the profile.

4. A program for causing a computer to function as the anomaly detection device according to any one of claims 1 to 3.

Images