Abnormality determination method, abnormality determination device, and program

Abstract

An anomaly determination method to be executed by a computer for determining the degree of anomaly of file access, the anomaly determination method including a step for acquiring an access pattern indicating an access trend based on a log of file access performed in the past, a step for acquiring an inspection target log of new file access that is to be inspected, a step for determining the degree of anomaly of the inspection target log using the acquired access pattern, and a step for outputting the determination result, wherein the more the inspection target log deviates from the acquired access pattern, the higher the degree of anomaly is determined in the determination step.

Description

Abnormality determination method, abnormality determination device, and program

[0001] The present disclosure relates to an abnormality determination method, an abnormality determination device, and a program.

[0002] In recent years, as the Internet of Things (IoT) has become increasingly prevalent in control systems such as factories, buildings, and power systems, cyberattacks targeting such IoT devices have also increased. Communication logs are monitored by gateways or the like on networks to which IoT devices are connected (see, for example, Patent Literature 1).

[0003] International Publication No. 2016 / 129093

[0004] However, there are cases where conventionally known methods for determining an abnormality are inappropriate. Therefore, an object of the present disclosure is to provide an abnormality determination method and the like that can more appropriately determine an abnormality.

[0005] An abnormality determination method according to one aspect of the present disclosure is an abnormality determination method executed by a computer for determining the degree of abnormality in access to a file, and includes the steps of acquiring an access pattern indicating access trends based on a log of past accesses to the file, acquiring an inspection target log of newly made accesses to the file that is the subject of inspection, determining the degree of abnormality of the inspection target log using the acquired access pattern, and outputting a determination result, wherein in the determination step, the degree of abnormality is determined to be higher the more the inspection target log deviates from the acquired access pattern.

[0006] Furthermore, an abnormality determination device according to one aspect of the present disclosure is an abnormality determination device that determines the degree of abnormality in access to a file, and includes a pattern acquisition unit that acquires an access pattern indicating an access trend based on a log of past accesses to the file, an inspection target acquisition unit that acquires an inspection target log of newly made accesses to the file that is the inspection target, a determination unit that determines the degree of abnormality of the inspection target log using the acquired access pattern, and an output unit that outputs the determination result, and the determination unit determines that the degree of abnormality is higher the more the inspection target log deviates from the acquired access pattern.

[0007] Furthermore, a program according to one aspect of the present disclosure is a program for causing a computer to execute the abnormality determination method described above.

[0008] According to the present disclosure, it is possible to more appropriately determine abnormalities.

[0009] FIG. 1 is a diagram illustrating an overall configuration of a file access anomaly detection system according to an embodiment. FIG. 2 is a diagram illustrating a more detailed configuration of a file access anomaly detection system according to an embodiment. FIG. 3 is a diagram illustrating a more detailed configuration of a file access anomaly detection system according to another example of the embodiment. FIG. 4 is a flowchart illustrating an example of operation of the file access anomaly detection system according to an embodiment. FIG. 5 is a flowchart illustrating an example of an access pattern learning process according to an embodiment. FIG. 6 is a flowchart illustrating an example of an access pattern learning process according to an embodiment. FIG. 7 is a diagram illustrating an example of data used in the access pattern learning process according to an embodiment. FIG. 8 is a diagram illustrating an example of data used in the access pattern learning process according to an embodiment. FIG. 9 is a diagram illustrating grouping according to an embodiment. FIG. 10 is a diagram illustrating grouping according to an embodiment. FIG. 11 is a diagram illustrating grouping according to an embodiment. FIG. 12 is a diagram illustrating grouping according to an embodiment. FIG. 13 is a flowchart illustrating an example of an access pattern learning process according to an embodiment. FIG. 14 is a diagram illustrating an example of data used in the access pattern learning process according to an embodiment. FIG. 15 is a diagram illustrating an example of data used in the access pattern learning process according to an embodiment. FIG. 16 is a diagram illustrating sequencing according to an embodiment. FIG. 17 is a diagram illustrating sequencing according to an embodiment. FIG. 18 is a flowchart illustrating an example of access pattern learning processing according to an embodiment. FIG. 19 is a diagram illustrating estimation of a terminal role according to an embodiment. FIG. 20 is a diagram illustrating estimation of a terminal role according to an embodiment. FIG. 21 is a diagram illustrating estimation of a terminal role according to an embodiment. FIG. 22 is a diagram illustrating an example of data used in the access pattern learning processing according to an embodiment. FIG. 23 is a flowchart illustrating an example of access log inspection processing according to an embodiment. FIG. 24 is a flowchart illustrating an example of access log inspection processing according to an embodiment.Fig. 25 is a flowchart showing an example of access log inspection processing according to an embodiment. Fig. 26 is a diagram showing an example of data used in the access log inspection processing according to an embodiment. Fig. 27 is a diagram showing an example of data used in the access log inspection processing according to an embodiment. Fig. 28 is a diagram showing an example of data used in the access log inspection processing according to an embodiment. Fig. 29 is a flowchart showing an example of access log inspection processing according to another example of the embodiment. Fig. 30 is a flowchart showing an example of access log inspection processing according to another example of the embodiment.

[0010] (Knowledge forming the basis of the present disclosure) As IoT advances in the field of control systems for factories, buildings, power systems, etc., there are an increasing number of cases in which control system networks are connected to the Internet for convenience and efficiency reasons. As a result, the risk of cyber attacks is increasing for control systems, just like for IT systems, and the introduction of security measures for control systems has become an urgent issue.

[0011] Because control systems place the utmost importance on system availability, it is not easy to implement common security measures such as antivirus software or security patches, which can affect availability. For this reason, control systems often adopt a configuration in which communication logs between devices are passively acquired and sent to an analysis device such as a SIEM, which centrally collects and manages the logs and monitors for the presence or absence of cyber attacks (i.e., whether there are any abnormalities or not).

[0012] On the other hand, even if access rights are granted and managed for each device, if a device with access rights to a file is hijacked, an attack targeting that file will be successful. Also, setting access rights for each file is not appropriate because it will result in false detection of operations such as creating new files.

[0013] In view of the above, the present disclosure provides an anomaly determination method, etc., that can be used to detect the presence or absence of an anomaly by determining the degree of anomaly based on deviation from an access pattern using an access pattern that has a certain degree of tolerance for operations constructed based on a log of access to a file.

[0014] In order to achieve the above, the anomaly determination method according to the first aspect of the present disclosure is an anomaly determination method executed by a computer to determine the degree of anomaly in access to a file, and includes the steps of acquiring an access pattern indicating an access trend based on a log of past accesses to the file, acquiring an inspection target log of newly made accesses to the file that is the subject of inspection, determining the degree of anomaly of the inspection target log using the acquired access pattern, and outputting the determination result, wherein in the determination step, the degree of anomaly is determined to be higher the more the inspection target log deviates from the acquired access pattern.

[0015] This allows the degree of anomaly to be determined as a deviation from the access pattern based on the log of past file accesses. By combining this with technology that expands the range of file path and other parameters that are considered to match in an access pattern, it is possible to prevent false positives, such as simply granting permission for each accessed file. Furthermore, even if a device with access authority is hijacked, an anomaly can be detected if the access pattern deviates from the access pattern based on the log of past accesses from that device. This allows for more accurate anomaly determination.

[0016] In addition, an abnormality determination method according to a second aspect of the present disclosure is the abnormality determination method described in the first aspect, which further includes, prior to the step of acquiring the access pattern, a step of constructing an access pattern based on a log of accesses to a file that have been made in the past, and in the step of acquiring the access pattern, the constructed access pattern is acquired.

[0017] This allows an access pattern to be constructed, and the constructed access pattern to be used to more appropriately determine whether an abnormality has occurred.

[0018] Furthermore, an abnormality determination method according to a third aspect of the present disclosure is the abnormality determination method described in the second aspect, and in the construction step, an access pattern is constructed based on logs of multiple sequences of consecutive accesses to each of two or more files that were made in the past, and based on logs of sequences that do not include any sequences that do not exceed a predetermined threshold number of times.

[0019] This makes it possible to exclude infrequent sequences of consecutive accesses that occur less than a predetermined threshold number of times, which corresponds to a sequence that is repeated to some extent, from being used in constructing an access pattern.As a result, it is possible to construct an access pattern by excluding file accesses that occur infrequently when viewed as a sequence, making it possible to more appropriately determine abnormalities from the perspective of the sequence.

[0020] Furthermore, an abnormality determination method according to a fourth aspect of the present disclosure is an abnormality determination method according to any one of the first to third aspects, wherein the inspection target log includes a sequence that is a log of successive accesses to each of two or more files, and the access pattern is constructed based on logs of multiple sequences of successive accesses to each of the two or more files that were made in the past.

[0021] According to this, by making newly performed accesses to a file into a sequence, direct comparison becomes possible when the access patterns are constructed in the form of a sequence.

[0022] Furthermore, an abnormality determination method according to a fifth aspect of the present disclosure is an abnormality determination method according to any one of the first to fourth aspects, in which the log to be inspected is converted using a wildcard to share the access paths of two or more similar files, and the access pattern is constructed based on a log converted using a wildcard to share the access paths of two or more similar files in the past.

[0023] This allows the range of matches to be expanded using wildcards, thereby reducing the occurrence of overdetection when determining an abnormality.

[0024] Furthermore, an abnormality determination method according to a sixth aspect of the present disclosure is the abnormality determination method described in the fifth aspect, wherein each of the access paths of two or more similar files is separated into a plurality of words, and the logs to be inspected and the logs for constructing the access patterns are converted by replacing, among the plurality of words, words whose frequency of appearance is equal to or less than a predetermined threshold with wildcards.

[0025] This allows the range of words that are considered to match to be expanded by replacing words that appear at a frequency below a predetermined threshold with wildcards, thereby reducing the occurrence of overdetection when determining whether an abnormality has occurred.

[0026] Furthermore, an abnormality determination method according to a seventh aspect of the present disclosure is an abnormality determination method described in any one of the first to sixth aspects, wherein the access pattern is linked to the time period of past access to the file indicated by the log used for construction, and in the determination step, the degree of abnormality is determined to be higher the more the time at which the log to be inspected was acquired deviates from the time period linked to the acquired access pattern.

[0027] This allows the degree of abnormality to be determined in terms of the time period in the determining step.

[0028] Furthermore, an abnormality determination method according to an eighth aspect of the present disclosure is an abnormality determination method described in any one of the first to seventh aspects, wherein the access pattern is linked to the role of the terminal that accessed the file in the past as indicated by the log used for construction, and the degree of abnormality is determined to be higher the more the role of the terminal that accessed the file in the log to be inspected deviates from the role of the terminal that made the access as linked to the acquired access pattern.

[0029] This allows the degree of abnormality to be determined in the determining step from the perspective of the role of the terminal.

[0030] Furthermore, an abnormality determination method according to a ninth aspect of the present disclosure is the abnormality determination method described in the eighth aspect, in which the role of the terminal that made the access, which is linked to the access pattern, is linked by estimation based on a comparison with accesses of terminals whose roles are known.

[0031] This allows the degree of abnormality to be determined in the determining step from the perspective of the role of the terminal associated by estimation.

[0032] Furthermore, an abnormality determination method according to a tenth aspect of the present disclosure is an abnormality determination method according to any one of the first to ninth aspects, wherein in the step of acquiring inspection target logs, the inspection target logs are acquired so as to include inspection target logs whose abnormality level was equal to or greater than a predetermined threshold in the immediately preceding determination result.

[0033] According to this, if the abnormality level in the immediately preceding determination result is equal to or greater than a predetermined threshold, that inspection target log can also be included.

[0034] A program according to an eleventh aspect of the present disclosure is a program for causing a computer to execute the abnormality determination method according to any one of the first to tenth aspects.

[0035] According to this, by having a computer execute the method, it is possible to achieve the same effect as the abnormality determination method described above.

[0036] Furthermore, an abnormality determination device according to a twelfth aspect of the present disclosure is an abnormality determination device that determines the degree of abnormality in access to a file, and includes a pattern acquisition unit that acquires an access pattern indicating an access trend based on a log of past accesses to the file, an inspection target acquisition unit that acquires an inspection target log of newly made accesses to the file that is the inspection target, a determination unit that determines the degree of abnormality of the inspection target log using the acquired access pattern, and an output unit that outputs the determination result, and the determination unit determines that the degree of abnormality is higher the more the inspection target log deviates from the acquired access pattern.

[0037] This can achieve the same effects as the abnormality determination method described above.

[0038] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Each of the embodiments described below represents a specific example of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in independent claims are described as optional components. Furthermore, the respective contents of all the embodiments and alternative examples can be combined.

[0039] In addition, the same reference numerals are used for the same components in each drawing.

[0040] Furthermore, in this specification, when a comparison is made, for example, with "above a threshold" or "below a threshold," it means that the distinction is made at the threshold, and may mean "greater than the threshold" or "below the threshold," respectively.

[0041] Furthermore, the numerical values ​​of the thresholds and the like in this embodiment are merely examples, and other numerical values ​​may be used. In the following explanation, the term "log" will be explained as a concept that includes both the information itself as acquired as a "log" and log-related information after a part or all of the information acquired as a "log" has been changed, such as by converting and aggregating it.

[0042] (Embodiment) [Overall Configuration] FIG. 1 is a diagram showing the overall configuration of an example of a file access anomaly detection system 10 according to this embodiment.

[0043] The file access anomaly detection system 10 is a system that includes an anomaly determination device, analyzes logs sent from devices such as IoT devices, and notifies a user of the presence or absence of anomalies as analysis results. The file access anomaly detection system 10 is realized by executing a predetermined program using a processor and memory. The file access anomaly detection system 10 is connected to a monitoring target 1, which is a device to be monitored, via a network, for example.

[0044] As shown in the figure, the file access anomaly detection system 10 includes an access pattern learning unit 20, an access log inspection unit 30, a communication information DB 40, a past file access information DB 50, a terminal information DB 60, and an access pattern storage unit 70.

[0045] Here, Fig. 2 is a diagram showing a more detailed configuration of a file access anomaly detection system according to an embodiment. Note that Fig. 2 does not include a communication information DB 40, which means that the communication information DB 40 is not essential to the configuration of Fig. 2. A configuration using the communication information DB 40 will be described in Fig. 3, which will be described later. As such, the configuration shown in the figure is one example.

[0046] As shown in the figure, the access pattern learning unit 20 is an information processing device for constructing access patterns, and includes a data acquisition unit 21, an access path grouping unit 22, an access path sequencing unit 23, and a terminal information assignment unit 24. The data acquisition unit 21 acquires a log of past accesses to files from the past file access information DB 50. The data acquisition unit 21 outputs the acquired log to other components.

[0047] The access path grouping unit 22 groups similar logs of past file accesses by grouping them together into a common group. Details of grouping will be described later.

[0048] The access path sequencing unit 23 sequences the logs of past accesses to files by grouping each series of logs into a single sequence. The details of sequencing will be described later.

[0049] The access path grouping unit 22 and the access path sequencing unit 23 can construct an access pattern that indicates access trends from the log. The access pattern includes information on access trends and has a certain tolerance for operations. In other words, even if the access paths are partially different or the sender is different, operations for accessing the same type of file are considered to match the same access pattern.

[0050] The terminal information assigning unit 24 reads information about the terminals involved in the log from the terminal information DB 60 and associates it with the access pattern. The access pattern to which the terminal information has been assigned is then stored in the access pattern storage unit 70.

[0051] The access log inspection unit 30 is an information processing device for inspecting access logs, and includes a data acquisition unit 31, an access path grouping unit 32, an access path sequencing unit 33, a terminal information assignment unit 34, a scoring unit 35, and a visualization unit 36. The data acquisition unit 31 is an example of an inspection target acquisition unit that acquires an inspection target log, and acquires a log of the most recent new access to a file from the monitoring target 1. The data acquisition unit 31 outputs the acquired log to other components.

[0052] The access path grouping unit 32 groups the logs of newly made accesses to the file by putting them into one of the groups.

[0053] The access path sequencing unit 33 sequences the logs of newly made accesses to the file by grouping each series of logs into one sequence.

[0054] The access path grouping unit 32 and the access path sequencing unit 33 can obtain log information in a similar format from the log for comparison with the access pattern.

[0055] The terminal information assigning unit 24 reads out, from the terminal information DB 60, information about the terminal involved in the log, such as the role of the terminal, and associates it with the log information.

[0056] The scoring unit 35 reads and acquires the access patterns stored in the access pattern storage unit 70, and compares them with the log information to which terminal information has been added, thereby scoring the log information according to the degree of deviation from the access pattern. The more the log information deviates from the access pattern, the higher the score, resulting in a higher degree of abnormality. On the other hand, the more the log information matches the access pattern, the lower the score, resulting in a lower degree of abnormality. In this way, the scoring unit 35 is an example of a pattern acquisition unit that acquires access patterns and a determination unit that uses the access patterns to determine the degree of abnormality of the log to be inspected.

[0057] The visualization unit 36 ​​outputs the result of the determination of the degree of abnormality by the scoring unit 35 as various outputs 80. As an example, the visualization unit 36 ​​visualizes the determination result as an image, but for example, based on the determination result, the visualization unit 36 ​​may compare the degree of abnormality indicated in the determination result with a threshold and, if the degree is equal to or greater than the threshold, issue an alert indicating that an abnormality exists, or may use a large-scale language model to explain what operations are being performed on what files with what names as a series of processes and display it as a message. The various outputs 80 include information related to such images and alerts.

[0058] 3, since the terminal information DB 60 is unavailable, the access pattern learning unit 20a estimates terminal information instead. Therefore, the access pattern learning unit 20a includes a configuration for estimating terminal information and a storage unit for storing the estimated information. Specifically, the access pattern learning unit 20a includes a terminal role estimation unit 25 for estimating terminal roles from information related to past inter-terminal communications stored in the communication information DB 40, and a terminal information storage unit 26 for storing the estimated terminal roles. The terminal information assigning unit 34 can then perform similar processing by accessing the terminal information storage unit 26 instead of the terminal information DB 60.

[0059] [Processing Procedure] Next, an example of the operation of the file access anomaly detection system 10 will be described with reference to Fig. 4 onwards. Fig. 4 is a flowchart showing an example of the operation of the file access anomaly detection system according to the embodiment.

[0060] Once installed, the file access anomaly detection system 10 of this embodiment basically operates continuously. By repeatedly executing the process described below, it is possible to monitor whether normal file accesses include highly anomalous operations.

[0061] As shown in Figure 4, the file access anomaly detection system 10 constructs a file access anomaly detection model (i.e., access pattern) by learning (construction step S11), and then uses the constructed file access anomaly detection model to inspect the access log for file accesses of the monitored object 1 (S12).

[0062] First, the construction step S11 will be described. FIGS. 5 and 6 are flowcharts showing an example of the access pattern learning process according to the embodiment. For example, as shown in FIG. 7, information about past file accesses is sequentially acquired and accumulated in the past file access information DB. FIGS. 7 and 8 are diagrams showing an example of data used in the access pattern learning process according to the embodiment. As shown in the figures, information about file access includes the date and time the information was sent or received, the sender, the destination, the communication protocol, whether it was read or written, and file path information. Here, file operations may also include deletion, etc.

[0063] As shown in Fig. 5, the access pattern learning unit 20 first performs a process of grouping previously accessed path information into common groups (S21). For example, as shown in Fig. 6, the access path grouping unit 22 acquires data on previously accessed paths (S31) and then clusters similar paths among them (S32). Clustering is performed based on information such as the same extension, the same parent directory, or the same child directory. Then, from each cluster, clusters with a certain number of paths classified into the same cluster are extracted (S33), and the paths in the extracted clusters are grouped as a common pattern (S34).

[0064] For example, FIGS. 9 to 12 are diagrams illustrating grouping according to an embodiment. As shown in FIG. 9 , assume that several paths are included in a cluster. The paths can be divided into multiple words using natural language processing or the like. The divided words are compiled into a single word list within the cluster, for example, as shown in FIG. 10 . Then, the frequency of each word in these word lists is calculated for paths within the cluster. As shown in FIG. 11 , words with a frequency exceeding a predetermined threshold are used as common words within the paths, and the remaining words are replaced with wildcards. This makes it possible to construct a common path, i.e., a group path, that applies uniformly to all paths within the cluster, as shown in FIG. 12 .

[0065] In this way, information on paths replaced with group paths can be obtained, as shown in Fig. 8, and this information is saved (S35). Note that for clusters that could not be replaced with group paths and have less than a certain number of classified paths, the paths are saved as is without being replaced with group paths (S36).

[0066] Returning to FIG. 5 , next, using access information for a certain period of time, sequencing is performed to extract information on a series of access sequences (S22). FIG. 13 is a flowchart showing an example of access pattern learning processing according to an embodiment. As shown in FIG. 13 , data on previously accessed paths is first acquired (S41), and those that have been grouped as described above are grouped by replacing them with wildcards (S42). FIGS. 14 and 15 are diagrams showing an example of data used in the access pattern learning processing according to an embodiment. For example, as shown in FIGS. 14 and 15 , file paths related to consecutive accesses to two or more files within a certain period of time are extracted as one sequence. From these transition sequences, those with high transition frequencies, i.e., those with a particularly high number of actual transitions in past logs, are extracted (S43). FIGS. 16 and 17 are diagrams for explaining sequencing according to an embodiment. Note that each of path A to path F in FIGS. 16 and 17 represents a single file path, and in a sequence, an actual occurrence of a sequence of access to a certain file path and access to a subsequent file path is counted as one occurrence. The results of counting the number of transitions for each sequence are shown in Figure 16. Figure 17 visually illustrates these results, with dashed arrows indicating sequences with a low number of transitions (less than a predetermined threshold), and bold arrows indicating sequences with a high number of transitions (greater than or equal to a predetermined threshold). In the example shown in the figure, the transition sequence from path A to path A, the transition sequence from path C to path B, the transition sequence from path D to path E, and the transition sequence from path E to path D are extracted as having a high transition frequency. By doing this, as shown in Figures 14 and 15, access patterns in the form of sequences are constructed for transition sequences with a high transition frequency. Note that access patterns with a low transition frequency are maintained in the form of paths rather than sequences (as shown in the example at the bottom of Figure 14).

[0067] 13, next, information about the time period during which the converted path sequence was executed is assigned to the access pattern (S44). Then, information about the transition sequence of the grouped paths is saved as the constructed access pattern (S45). Note that frequently occurring transition sequences between ungrouped access paths, and between sequences of ungrouped access paths and grouped access paths, may also be saved as access patterns.

[0068] Returning to Fig. 5, next, terminal role information is assigned to the transition sequence (S23). Fig. 18 is a flowchart showing an example of access pattern learning processing according to an embodiment. First, it is determined whether or not there is terminal role information (S51). If there is no terminal role information (No in S51), the terminals are clustered, and a terminal with an unknown role that is classified into the same cluster as a terminal with a known role is estimated to have the same role as a terminal with a known role (S52). Figs. 19 to 21 are diagrams for explaining estimation of terminal roles according to an embodiment.

[0069] As shown in FIG. 19 , for example, assume that there are terminals X and Y whose roles are known, and terminal Z whose role is unknown. As shown in FIG. 20 , these terminals receive information from terminal A via the HTTP protocol and transmit information to terminal B via the SMB protocol. If a graph chart of communication relationships such as that shown in FIG. 20 can be constructed, the similarity of each node can be calculated by performing existing graph analysis such as graph neural network (GNN). As an example, FIG. 22 shows the results of similarity calculation. As shown in FIG. 21 , if the calculated similarity between terminal Z and terminal X or terminal Y is equal to or greater than a certain threshold, it may be inferred that these terminals have the same role, and the role of terminal Z may be inferred to be "control device." Note that information regarding past inter-terminal communications such as that described above, which is used to infer the roles of terminals, is stored in the communication information DB 40.

[0070] Returning to FIG. 18 , next, information on the transition sequence, i.e., the access pattern, and information on the role of the terminal are linked (S53). Note that if the terminal information DB 60 or the like is available, the role information of the terminal is available (Yes in S51), so step S52 is skipped and step S53 is performed. FIG. 22 is a diagram illustrating an example of data used in the access pattern learning process according to the embodiment. In this manner, for example, as shown in FIG. 22 , information is constructed in which a time period, a role of the terminal, and an access pattern, which is a file path or a transition sequence, are linked. In FIG. 22 , the role of the source terminal, "src_machine_role," is linked to the access pattern, but the role information of the destination terminal may also be used to manage the access pattern.

[0071] Next, step S12 will be described. FIGS. 23 to 25 are flowcharts illustrating an example of the access log inspection process according to the embodiment. FIGS. 26 to 28 are diagrams illustrating an example of data used in the access log inspection process according to the embodiment. As shown in FIG. 23, first, a sequence of access data to files over a certain period of time for the monitoring target 1 as the inspection target is acquired (S61). For example, information such as that shown in FIG. 26 is obtained. Multiple time periods for acquiring this sequence may be prepared. That is, both a period including two logs and a period including three or more logs from the same multiple logs may be set. Note that the example shown in FIG. 26 includes two sequences, #1 and #2. Sequence #1 corresponds to the transition sequence of the second row shown in FIG. 22, and sequence #2 corresponds to the transition sequence of the third row shown in FIG. 22.

[0072] Next, the file paths as elements of the sequence are converted into grouped paths so as to be similar information that can be compared with groups in the access pattern (S62). The conversion process is the same as that described in the grouping of the access pattern learning process, and therefore will not be described here.

[0073] Next, the constructed access pattern is acquired and used to calculate the degree of anomaly of the access data (S63). Here, the calculation of the degree of anomaly of the access data is performed by counting at least one of the number of times a sequence or access path matches a past access pattern and the number of times it does not match (S71), and then calculating the degree of anomaly from at least one of the counted number of matches and numbers of times it does not match (S72), as shown in Fig. 24.

[0074] More specifically, as shown in FIG. 25, after counting at least one of the number of matches and the number of mismatches in step S71, steps S81 to S88 are performed as step S72. First, if there are mismatched sequences or access paths (Yes in S81, if the count is not 0), the number of mismatched new sequences is counted to calculate α1 (S82). Similarly, the number of mismatched new access paths is counted to calculate α2 (S83). Furthermore, the number of sequences and / or access paths with different roles is counted to calculate α3 (S84). Furthermore, the number of sequences and / or access paths with different time periods is counted to calculate α4 (S85). Then, it is determined whether the source terminal is a new terminal and α5 is calculated (S86).

[0075] The degree of abnormality of the access is calculated using the α1 to α5 obtained in this way (S87). The degree to which each of α1 to α5 contributes to the calculated degree of abnormality may be adjustable, but at least the larger the values ​​of α1 to α4, the higher the calculated degree of abnormality. In other words, the greater the number of new sequences, the greater the number of new access paths, the higher the abnormality. The greater the number of sequences and / or access paths with different roles (the more divergent the roles in the access pattern), and the greater the number of sequences and / or access paths with different time periods (the more divergent the time periods in the access pattern). Also, α5 is a binary judgment, and if the source terminal is a new terminal, the abnormality is calculated to be high, and if the source terminal is not a new terminal, the abnormality is calculated to be low.

[0076] If there are no mismatched sequences or access paths (No in S81, the count is 0), the degree of abnormality is calculated as 0 (S88).

[0077] Returning to FIG. 23 , the presence or absence of an anomaly is detected based on a threshold value for the calculated anomaly level (S64). The result of the determination is then visualized (S65). For example, if the anomaly level is equal to or greater than the threshold value, images such as those shown in FIGS. 27 and 28 are output as visualized determination results. As shown in the figures, the output image includes a message indicating the occurrence of an anomaly, as well as the date and time of occurrence of the sequence or access path with a high degree of anomaly, source terminal information, destination terminal information, and the number of accesses. The output image then displays the entire access sequence ( FIG. 27 ), new access patterns ( FIG. 28 ), and new access paths (not shown), which can be switched by using tabs. In this way, in this embodiment, the anomaly level can be determined as a deviation from the access pattern based on the normal file access log. This method is not based on a method that simply grants permission for each accessed file, which can lead to false detection, and it is possible to detect anomalies even if a terminal with access authority is hijacked.

[0078] 29 and 30 are flowcharts showing an example of an access log inspection process according to another embodiment of the present invention.

[0079] FIG. 29 shows a flowchart of a process similar to that shown in FIG. 25 . The access log inspection process according to the alternative example shown in the figure differs in that step S91 is newly implemented and step S87a is implemented instead of step S87. Specifically, as shown in FIG. 29 , after step S71 and before step S81, a base score is calculated based on at least one of the counted number of matches and the counted number of mismatches (S91). Then, after calculating α1 to α5 in steps S82 to S86, the degree of anomaly is calculated in step S87a using α1 to α5 to correct the base score. This makes it possible to adjust the influence of α1 to α5 by adjusting how the base score is corrected.

[0080] FIG. 30 also shows a flowchart of a process similar to that shown in FIG. 23 . The access log inspection process according to the alternative example shown in the figure differs in that steps S101 and S102 are newly implemented. Specifically, as shown in FIG. 30 , after step S61 but before step S61, it is determined whether the abnormality level during the previous inspection was 0 (S101). If the abnormality level during the previous inspection was not 0 (No in S101), a sequence to be inspected is added so that the sequence from the previous inspection is also included in the current inspection (S102). Then, the process proceeds to step S62. If the abnormality level during the previous inspection was 0 (Yes in S101), step S102 is skipped. As a result, the sequences to be inspected include the sequence from the previous inspection in addition to the sequence acquired in step S61. By doing this, it is possible to suppress over-detection, such as when a sequence that caused an increase in the degree of abnormality in the previous test is determined not to be abnormal when the current sequence is also considered, or to complement continuous data on abnormal access, such as when a more detailed determination of the degree of abnormality can be made when the current sequence is also considered.

[0081] Other Embodiments Although the anomaly detection method and the like according to the present disclosure have been described above based on the embodiments, the present disclosure is not limited to the above-described embodiments and modifications.

[0082] For example, the present disclosure may be embodied as the above-described methods. Furthermore, the present disclosure may be embodied as a computer program for implementing these methods on a computer, or as a digital signal comprising a computer program. For example, one aspect of the present disclosure may be a computer program for causing a computer to execute each of the characteristic steps included in the log priority calculation method.

[0083] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0084] The present disclosure may also be applied to transmitting a computer program or digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0085] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0086] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0087] Furthermore, the above-described embodiments and modifications may be combined with each other. Furthermore, various modifications that a person skilled in the art may conceive of may be made to the present embodiment, and configurations constructed by combining components of different embodiments may also be included in the present disclosure, as long as they do not deviate from the spirit of the present disclosure.

[0088] The present disclosure is useful for an apparatus for determining an abnormality.

[0089] 1 Monitoring target 10 File access anomaly detection system 20, 20a Access pattern learning unit 21, 31 Data acquisition unit 22, 32 Access path grouping unit 23, 33 Access path sequencing unit 24, 34 Terminal information assignment unit 25 Terminal role estimation unit 26 Terminal information storage unit 30 Access log inspection unit 35 Scoring unit 36 ​​Visualization unit 40 Communication information DB 50 Past file access information DB 60 Terminal information DB 70 Access pattern storage unit 80 Various outputs

Claims

1. An anomaly determination method executed by a computer for determining the degree of anomaly in access to a file, comprising: a step of acquiring an access pattern indicating an access tendency based on a log of past accesses to the file; a step of acquiring an inspection target log of newly made accesses to the file that is the subject of inspection; a step of determining the degree of anomaly of the inspection target log using the acquired access pattern; and a step of outputting a determination result, wherein in the determination step, the degree of anomaly is determined to be higher the more the inspection target log deviates from the acquired access pattern.

2. The method for determining an abnormality according to claim 1, further comprising, prior to the step of acquiring the access pattern, a step of constructing the access pattern based on a log of past accesses to a file, wherein the step of acquiring the access pattern includes acquiring the constructed access pattern.

3. The anomaly determination method according to claim 2, wherein in the constructing step, the access pattern is constructed based on logs of multiple sequences of consecutive accesses to two or more files that have been made in the past, and based on logs of sequences that do not include any sequences that do not exceed a predetermined threshold number of times.

4. The method for determining an anomaly according to any one of claims 1 to 3, wherein the inspection target log includes a sequence that is a log of successive accesses to each of two or more files, and the access pattern is constructed based on logs of multiple sequences of successive accesses to each of two or more files that were made in the past.

5. The method for determining an anomaly described in any one of claims 1 to 4, wherein the inspection target log is converted using a wildcard to share the access path of two or more similar files, and the access pattern is constructed based on a log converted using a wildcard to share the access path of two or more similar files in the past.

6. The method for determining an anomaly described in claim 5, wherein each of the access paths of two or more similar files is divided into a plurality of words, and the inspection target log and the log for constructing the access pattern are converted by replacing words among the plurality of words whose frequency of occurrence is below a predetermined threshold with wildcards.

7. The method for determining an anomaly according to any one of claims 1 to 6, wherein the access pattern is linked to a time period of past file accesses indicated by a log used for construction, and in the determining step, the degree of anomaly is determined to be higher the more the time at which the inspection target log was acquired deviates from the time period linked to the acquired access pattern.

8. The method for determining an anomaly according to any one of claims 1 to 7, wherein the access pattern is linked to the role of the terminal that accessed the file in the past as indicated in the log used for construction, and the degree of anomaly is determined to be higher the more the role of the terminal that accessed the file in the inspection target log deviates from the role of the terminal that made the access as linked to the acquired access pattern.

9. The method for determining an anomaly according to claim 8, wherein the role of the terminal that made the access, which is linked to the access pattern, is estimated based on a comparison with accesses made by terminals whose roles are known.

10. An anomaly determination method according to any one of claims 1 to 9, wherein in the step of acquiring the inspection target logs, the inspection target logs are acquired so as to include the inspection target logs whose degree of anomaly was equal to or greater than a predetermined threshold in the immediately preceding determination result.

11. A program for causing the computer to execute the abnormality determination method according to any one of claims 1 to 10.

12. An abnormality determination device that determines the degree of abnormality in access to a file, comprising: a pattern acquisition unit that acquires an access pattern that indicates an access trend based on a log of past accesses to the file; an inspection target acquisition unit that acquires an inspection target log of newly made accesses to the file that is the inspection target; a determination unit that determines the degree of abnormality of the inspection target log using the acquired access pattern; and an output unit that outputs a determination result, wherein the determination unit determines that the degree of abnormality is higher the more the inspection target log deviates from the acquired access pattern.

Images