Insider crime detection device, insider crime detection method, and insider crime detection program

Abstract

An insider crime detection device (100) is a device for detecting an insider crime. A risk value calculation unit (121) acquires an operation log and calculates risk values indicating the security risk of users. A risk value storage unit (122) stores the risk values in a risk value database (52) in association with date / time information. A tendency determination unit (123) acquires risk values for a certain period from the risk values stored in the risk value database (52). The tendency determination unit (123) also calculates a tendency (32) of the risk values for a certain period of time. The tendency determination unit (123) determines the presence or absence of insider crimes of the users on the basis of the tendency (32) of the risk values.

Description

Internal crime detection device, internal crime detection method, and internal crime detection program

[0001] The present disclosure relates to an insider crime detection device, an insider crime detection method, and an insider crime detection program, and more particularly to an insider crime detection device, an insider crime detection method, and an insider crime detection program that detect model poisoning attacks, which are techniques used by insiders to evade monitoring.

[0002] Monitoring and defense models that generally trust authenticated users make it difficult to counter attackers who steal authentication information, i.e., insiders. Therefore, defense using the UEBA model, which uses machine learning technology to analyze user behavior and detect anomalies, is necessary. UEBA is an abbreviation for User and Entity Behavior Analytics. The UEBA model is generated by using machine learning and deep learning to learn the normal behavior of users or other entities on an internal network. The UEBA model is a model that detects anomalous behavior in users or other entities on an internal network and estimates whether that behavior has a security impact.

[0003] A model poisoning attack is a technique used by insiders to evade monitoring by the UEBA model. In a model poisoning attack, an insider intentionally creates an anomaly, causing the UEBA model to re-learn, and during the re-learning period, performs operations related to insider crimes, i.e., fraudulent activities. This causes the model to learn that operations related to insider crimes are normal. By repeating this re-learning process, the UEBA model eventually becomes unable to detect insider crimes.

[0004] Patent Document 1 discloses a technology that monitors employee behavior over a certain period of time, detects suspected fraudulent behavior such as prohibited actions or operations that occur more frequently than usual, and quantifies the results to calculate a risk score for each employee.

[0005] Japanese Patent Application Laid-Open No. 2019-204389

[0006] Patent Literature 1 calculates a risk score based on prohibited actions or actions that occur more frequently than normal. However, because legitimate business operations vary widely, it is difficult to distinguish between legitimate business operations and insider crimes based on the frequency of operations. Therefore, there is a problem in that it is not possible to detect insider crimes that gradually contaminate the model by using only actions that are not prohibited but are related to insider crimes.

[0007] The present disclosure aims to appropriately detect insider attacks, which are attacks that are carried out gradually in a user's environment and gradually contaminate a model.

[0008] The internal crime detection device according to the present disclosure comprises a risk value calculation unit that acquires a user's operation log in the user environment and calculates a risk value that represents the security risk for the user; a risk value storage unit that associates the risk value with date and time information and stores it in a risk value database; and a trend determination unit that acquires risk values ​​for a certain period from the risk values ​​stored in the risk value database, calculates the trend of the risk values ​​for the certain period, and determines whether or not an internal crime has been committed by the user based on the trend of the risk values.

[0009] The insider crime detection device according to the present disclosure can appropriately detect insider crimes, which are attacks that are carried out gradually in a user's environment.

[0010] A diagram showing an example of the configuration of an internal crime detection device according to embodiment 1. A diagram showing an example of the functional configuration of an internal crime detection device according to embodiment 1. A flow diagram showing an example of the operation of an internal crime detection device according to embodiment 1. A flow diagram showing a detailed example of the operation of risk value calculation processing according to embodiment 1. A diagram showing an example of a risk value database according to embodiment 1. A flow diagram showing a detailed example of the operation of trend determination processing according to embodiment 1. A diagram showing an example of the trend of risk values ​​according to embodiment 1. A diagram showing an example of the configuration of an internal crime detection device according to a modified example of embodiment 1.

[0011] The present embodiment will be described below with reference to the drawings. In each drawing, the same or corresponding parts are assigned the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.

[0012] Embodiment 1. ***Configuration*** FIG. 1 is a diagram illustrating an example of the configuration of an insider crime detection device 100 according to this embodiment. FIG. 2 is a diagram illustrating an example of the functional configuration of the insider crime detection device 100 according to this embodiment. The insider crime detection device 100 is a device that detects insider crimes committed by a user in a user environment 200 in which security measures 210 are implemented. The user environment 200 is an environment in which security measures 210 are implemented, which analyze the user's normal behavior using machine learning technology to generate a normal model and detect fraudulent activity committed by the user using the normal model. For example, the security measures 210 are measures that use UEBA, and the normal model is a UEBA model. UEBA is an abbreviation for User and Entity Behavior Analytics. An insider crime committed by a user is a model contamination attack that contaminates the normal model by retraining the normal model by retraining fraudulent activity as normal. The process of detecting insider crimes committed by a user will be described later.

[0013] The internal crime detection device 100 is a computer. The internal crime detection device 100 includes a processor 910, as well as other hardware such as a memory 921, an auxiliary storage device 922, an input interface 930, an output interface 940, and a communication device 950. The processor 910 is connected to the other hardware via signal lines and controls the other hardware.

[0014] The internal crime detection device 100 comprises, as functional elements, a monitoring unit 110, a risk value processing unit 120, and a memory unit 150. The memory unit 150 stores an operation log 51, a risk value database 52, and a threshold value 53. As shown in FIG. 2 , the monitoring unit 110 comprises a user environment monitoring unit 111, an operation log extraction unit 112, and a relearning flag generation unit 113. The risk value processing unit 120 also comprises a risk value calculation unit 121, a risk value storage unit 122, a trend determination unit 123, and an alert generation unit 124.

[0015] The functions of the monitoring unit 110 and the risk value processing unit 120 are realized by software. The storage unit 150 is provided in the memory 921. Note that the storage unit 150 may be provided in the auxiliary storage device 922, or may be provided separately in the memory 921 and the auxiliary storage device 922.

[0016] The processor 910 is a device that executes an internal crime detection program. The internal crime detection program is a program that realizes the functions of the monitoring unit 110 and the risk value processing unit 120. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0017] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that saves data. A specific example of the auxiliary storage device 922 is an HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, or DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0018] The input interface 930 is a port connected to an input device such as a mouse, keyboard, or touch panel. Specifically, the input interface 930 is a USB terminal. The input interface 930 may also be a port connected to a LAN. USB is an abbreviation for Universal Serial Bus. LAN is an abbreviation for Local Area Network.

[0019] The output interface 940 is a port to which a cable of an output device 941 such as a display is connected. Specifically, the output interface 940 is a USB terminal or an HDMI (registered trademark) terminal. Specifically, the display is an LCD. The output interface 940 is also called a display interface. HDMI (registered trademark) is an abbreviation for High Definition Multimedia Interface. LCD is an abbreviation for Liquid Crystal Display.

[0020] The communication device 950 has a receiver and a transmitter. The communication device 950 is connected to a communication network such as a LAN, the Internet, a telephone line, or Wi-Fi (registered trademark). Specifically, the communication device 950 is a communication chip or NIC. NIC is an abbreviation for Network Interface Card.

[0021] The internal crime detection program is executed in the internal crime detection device 100. The internal crime detection program is loaded into the processor 910 and executed by the processor 910. The memory 921 stores not only the internal crime detection program but also the OS. OS is an abbreviation for Operating System. The processor 910 executes the internal crime detection program while executing the OS. The internal crime detection program and the OS may be stored in an auxiliary storage device 922. The internal crime detection program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that part or all of the internal crime detection program may be incorporated into the OS.

[0022] The internal crime detection device 100 may include multiple processors that replace the processor 910. These multiple processors share the task of executing the internal crime detection program. Each processor is a device that executes the internal crime detection program in the same way as the processor 910.

[0023] Data, information, signal values ​​and variable values ​​used, processed or output by the internal crime detection program are stored in memory 921, auxiliary storage device 922, or registers or cache memory within processor 910.

[0024] The "unit" of each unit of the monitoring unit 110 and the risk value processing unit 120 may be read as a "circuit," "process," "procedure," "process," or "circuitry." The internal crime detection program causes a computer to execute each of the monitoring process and risk value processing. The "process" of each of the monitoring process and risk value processing may be read as a "program," "program product," "computer-readable storage medium storing a program," or "computer-readable recording medium recording a program." Furthermore, the internal crime detection method is a method carried out by the internal crime detection device 100 executing the internal crime detection program. The internal crime detection program may be provided by being stored in a computer-readable recording medium. Furthermore, the internal crime detection program may be provided as a program product.

[0025] ***Explanation of Operation*** Next, the operation of the internal crime detection device 100 according to this embodiment will be described. The operating procedure of the internal crime detection device 100 corresponds to an internal crime detection method. Furthermore, the program that causes a computer to execute the internal crime detection process, which is the operation of the internal crime detection device 100, corresponds to an internal crime detection program.

[0026] An overview of the functions of the monitoring unit 110 and risk value processing unit 120 in the internal crime detection device 100 will be described. The monitoring unit 110 monitors user behavior and security measures 210 such as UEBA in a user environment 200, which is an IT system environment within an organization. IT is an abbreviation for Information Technology. The monitoring unit 110 monitors user behavior and acquires an operation log 51 generated by user operations. Furthermore, the monitoring unit 110 generates a relearning flag 31 when relearning occurs in UEBA by monitoring UEBA. The operation log 51 and relearning flag 31 are output to the risk value processing unit 120. The risk value processing unit 120 receives the operation log 51 and relearning flag 31 output from the monitoring unit 110 as input. The risk value processing unit 120 calculates the possibility that the user's behavior is an inside crime for each relearning. The risk value processing unit 120 further calculates a risk value trend 32 from past risk values. If the risk value processing unit 120 determines that there is a possibility of a model contamination attack based on the calculated risk value trend 32, it outputs an alert generation flag 33. Specifically, this is as follows.

[0027] 3 is a flow diagram showing an example of the operation of the internal crime detection device 100 according to this embodiment. The user environment 200 is, for example, an IT system environment within an organization. In the user environment 200, a security measure 210 is implemented. Specifically, the user environment 200 is an environment in which a security measure is implemented in which a normal user's behavior is analyzed using machine learning technology to generate a normal model, and the normal model is used to detect fraud by the user. For example, the security measure 210 is a measure using UEBA, and the normal model is the UEBA model.

[0028] In step S101, UEBA, a security measure, is implemented in the user environment 200. The user environment monitoring unit 111 of the monitoring unit 110 monitors user behavior in the user environment 200. Based on the monitoring of user behavior by the user environment monitoring unit 111, the operation log extraction unit 112 of the monitoring unit 110 acquires operation logs generated by user operations.

[0029] <Relearning Flag Generation Process> In step S102, the relearning flag generation unit 113 of the monitoring unit 110 detects the occurrence of relearning of the UEBA model and generates a relearning flag notifying the occurrence of relearning. Typically, relearning is performed when a major change such as a change in organization or operational tasks is made. On the other hand, in an internal crime, the UEBA model is gradually contaminated by operations that are not prohibited but are related to the internal crime. In such an internal crime, relearning is intentionally triggered in UEBA, gradually contaminating the UEBA model. The relearning flag generation unit 113 monitors whether relearning has started in UEBA, and turns on the relearning flag when relearning has started.

[0030] After generating the relearning flag, the relearning flag generation unit 113 notifies the risk value calculation unit 121 of the risk value processing unit 120 of the relearning flag and the operation log acquired in step S101. For example, the relearning flag generation unit 113 notifies the risk value calculation unit 121 of the operation log of the operation input to the UEBA. Alternatively, the risk value calculation unit 121 may monitor the relearning flag and acquire the operation log when the relearning flag is turned on.

[0031] Here, the operation log will be described. The operation log extraction unit 112 extracts the operation log when a relearning flag is generated. The operation log refers to all logs on a PC (Personal Computer) generated by user operations during relearning. For example, the operation log is a user log entered into the UEBA during relearning. The log entity is data having two minimum elements: "execution time" and "event information." Event information corresponds to the name and content of events generated on the PC by the user, such as "PC shutdown / login," "application launch / termination," and "email sending / receiving data."

[0032] <Risk Value Calculation Process> In step S103, the risk value calculation unit 121 calculates a risk value upon receiving the relearning flag. Alternatively, the risk value calculation unit 121 may calculate a risk value upon detecting that the relearning flag is on. The risk value calculation unit 121 acquires an operation log of the user in the user environment 200 and calculates a risk value that represents the security risk to the user. For example, the risk value calculation unit 121 acquires the operation log and relearning flag 31 output from the monitoring unit 110, and calculates, for each relearning, the possibility that the user's behavior is an insider crime as a risk value.

[0033] The risk value storage unit 122 stores the calculated risk value in the risk value database 52 in association with the date and time information.

[0034] 4 is a flow diagram showing a detailed operation example of the risk value calculation process according to this embodiment. In step S301, the risk value calculation unit 121 acquires an operation log in response to the acquisition of a re-learning flag. For example, the risk value calculation unit 121 acquires the input data of the UEBA operated in step S101 as the operation log. In step S302, the risk value calculation unit 121 calculates the possibility of an insider crime as a risk value based on the UEBA input data acquired in step S301, i.e., the user's operation log.

[0035] Examples of methods for calculating risk values ​​include (1) and (2) below. (1) The risk value calculation unit 121, based on threat information related to insider crimes, numerically associates each operation included in a user's operation log with the degree of relevance to insider crimes. For example, based on threat information related to insider crimes, the risk value calculation unit 121 performs processing such as numerically associating the degree to which the operation "delete a file" included in a user's operation log is related to insider crimes. Then, the risk value calculation unit 121 determines the sum of the numerical values ​​for all operation logs as the risk value. (2) The risk value calculation unit 121 calculates the distribution of the operation logs of all users within the organization and determines the degree of deviation from the distribution of the operation logs of the user for which the risk value is to be calculated as the risk value.

[0036] In step S303, the risk value storage unit 122 stores the risk value calculated in step S302 in the risk value database 52 in association with the date and time information of the risk value calculation in the risk value calculation unit 121. The date and time information is in a format conforming to, for example, ISO 8601.

[0037] FIG. 5 is a diagram showing an example of a risk value database 52 according to this embodiment. The risk value database 52 includes a risk value calculation execution date 521, which is date and time information, and a risk value 522. In the example of FIG. 5, the risk value calculation execution date 521 is a date, but it may also be a date and time. For example, assume that relearning using UEBA occurred every day from April 1 to April 6. In this case, the risk value calculation unit 121 calculates a risk value for each day from April 1 to April 6. The risk value storage unit 122 then associates the execution date 521 of the risk value calculation unit 121 with the risk value 522 calculated at that time and stores them in the risk value database 52.

[0038] <Trend Determination Process> Next, the trend determination unit 123 obtains risk values ​​for a certain period from the risk values ​​stored in the risk value database 52. Then, the trend determination unit 123 calculates the trend of the risk values ​​for the certain period. The trend determination unit 123 determines whether or not an insider crime has been committed by a user based on the trend of the risk values. Specifically, this is as follows.

[0039] In step S104, the trend determination unit 123 calculates the trend of the risk values ​​based on the risk values ​​stored in the risk value database 52. Then, the trend determination unit 123 determines the possibility of a model contamination attack using the trend of the risk values. If the trend determination unit 123 determines that the trend of the risk values ​​indicates the possibility of a model contamination attack, it outputs an alert generation flag. Specifically, the trend determination unit 123 compares the trend of the risk values ​​with a threshold, and if the trend of the risk values ​​is equal to or greater than the threshold, it determines that an insider crime has occurred by the user. If the trend determination unit 123 determines that an insider crime has occurred by the user, it outputs an alert generation flag that warns of an insider crime by the user.

[0040] 6 is a flow diagram showing a detailed operation example of the trend determination process according to this embodiment. In step S401, the trend determination unit 123 acquires information in which risk values ​​stored in the risk value database 52 are associated with date and time information for risk value calculation. In step S402, the trend determination unit 123 calculates the trend of the risk values ​​based on the information in which risk values ​​are associated with date and time information for risk value calculation.

[0041] Examples of methods for calculating the trend of risk values ​​include (3) and (4) below. (3) The trend determination unit 123 performs a simple regression analysis on data in which corresponding risk values ​​are arranged in chronological order based on the date and time information of the risk value calculation, and calculates the magnitude of the slope of the resulting line as the trend of the risk value. (4) The trend determination unit 123 calculates the degree of deviation between the risk value at an arbitrary point in the past and the risk value of the latest data as the trend of the risk value.

[0042] In step S403, the trend determination unit 123 determines whether the trend of the risk values ​​indicates the possibility of a model contamination attack. For example, the trend determination unit 123 determines whether the trend of the risk values ​​indicates the possibility of a model contamination attack based on whether the trend of the risk values ​​is equal to or greater than a threshold.

[0043] FIG. 7 is a diagram showing an example of the risk value trend 32 according to this embodiment. The trend determination unit 123 calculates the risk value trend based on risk values ​​for a certain period stored in the risk value database 52. For example, the trend determination unit 123 calculates the risk value trend based on risk values ​​from the past to the present as a certain period. In FIG. 7 , for example, if the present is April 6, the certain period is the three days going back from April 6 to April 3. Also, for example, if the present is April 3, the certain period is the three days going back from April 3 to April 1. Note that the certain period is not limited to three days and may be any predetermined period (for example, two days or 12 hours). The trend determination unit 123 then determines whether or not there is a possibility of a model contamination attack based on the risk value trend.

[0044] Examples of methods for determining whether a model contamination attack is likely based on a risk value trend include (5) or (6) below. (5) The trend determination unit 123 performs a simple regression analysis on data in which risk values ​​corresponding to the date and time information of risk value calculations are arranged in chronological order. The trend determination unit 123 determines whether a model contamination attack is likely based on the slope of the resulting line as the trend of the risk values ​​((3) above). The trend determination unit 123 determines whether a model contamination attack is likely based on whether the magnitude of the slope of the line is equal to or greater than a certain threshold. (6) The trend determination unit 123 calculates the degree of discrepancy between the risk value of the previous data and the risk value of the latest data as the trend of the risk values ​​((4) above). The trend determination unit 123 determines that there is a trend that a model contamination attack is likely based on the degree of discrepancy being equal to or greater than a certain threshold.

[0045] If the trend determination unit 123 determines that the trend indicates a possibility of a model contamination attack, the process proceeds to step S404. If the trend determination unit 123 determines that the trend indicates a possibility of a model contamination attack, the process ends. In step S404, the trend determination unit 123 generates and outputs an alert generation flag.

[0046] <Alert Generation Process> When the alert generation unit 124 acquires the alert generation flag (YES in step S105), it generates a detection alert 34 that warns the user of an insider crime (step S106). The alert generation unit 124 outputs the detection alert 34 (step S107). The alert generation unit 124 outputs the detection alert 34 to the output device 941. The detection alert 34 is output to, for example, the user himself or herself or a system administrator.

[0047] ***Other Configurations*** In this embodiment, the functions of the monitoring unit 110 and the risk value processing unit 120 are realized by software. As a variation, the functions of the monitoring unit 110 and the risk value processing unit 120 may be realized by hardware. Specifically, the internal crime detection device 100 includes an electronic circuit 909 instead of the processor 910.

[0048] 8 is a diagram showing an example of the configuration of an internal crime detection device 100 according to a modified example of this embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of the monitoring unit 110 and the risk value processing unit 120. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0049] The functions of the monitoring unit 110 and the risk value processing unit 120 may be realized by a single electronic circuit, or may be realized by distributing them across multiple electronic circuits.

[0050] As another variation, some of the functions of the monitoring unit 110 and risk value processing unit 120 may be implemented by electronic circuits, with the remaining functions implemented by software. Also, some or all of the functions of the monitoring unit 110 and risk value processing unit 120 may be implemented by firmware.

[0051] Each of the processor and the electronic circuit is also called processing circuitry. That is, the functions of the monitoring unit 110 and the risk value processing unit 120 are realized by the processing circuitry.

[0052] ***Explanation of the effects of this embodiment*** As described above, the internal crime detection device of this embodiment has the effect of being able to properly detect internal crimes even in a situation where UEBA has been contaminated by a model contamination attack that gradually contaminates the normal model.

[0053] Typically, a UEBA that has been subjected to a model contamination attack experiences a decline in its detection accuracy for behavior related to insider crimes with each re-learning. As a result, it ultimately becomes unable to detect insider crimes at all. The insider crime detection device according to this embodiment acquires a user's operation log with each re-learning and stores the calculated risk value in a database. Then, by calculating the trend in the risk value and monitoring the increase in the likelihood of insider crimes with each re-learning, it is possible to accurately detect model contamination attacks.

[0054] In the first embodiment described above, each part of the internal crime detection device has been described as an independent functional block. However, the configuration of the internal crime detection device does not have to be the same as that of the above-described embodiment. The functional blocks of the internal crime detection device may have any configuration as long as they can realize the functions described in the above-described embodiment. Furthermore, the internal crime detection device may not be a single device, but may be a system composed of multiple devices. Furthermore, multiple parts of the first embodiment may be combined to implement the first embodiment. Alternatively, only one part of the first embodiment may be implemented. In addition, the first embodiment may be combined in any way, either as a whole or in part. In other words, in the first embodiment, parts of the first embodiment may be freely combined, or any component of the first embodiment may be modified or omitted.

[0055] The above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, or the scope of use of the present disclosure. The above-described embodiments can be modified in various ways as needed. For example, the procedures described using flow charts or sequence diagrams may be modified as appropriate.

[0056] Various aspects of the present disclosure are summarized below as appendices.

[0057] (Supplementary Note 1) An internal crime detection device comprising: a risk value calculation unit that acquires a user's operation log in a user environment and calculates a risk value that represents a security risk to the user; a risk value storage unit that associates the risk value with date and time information and stores the risk value in a risk value database; and a trend determination unit that acquires risk values ​​for a certain period from the risk values ​​stored in the risk value database, calculates a trend of the risk values ​​for the certain period, and determines whether or not an inside crime has been committed by the user based on the trend of the risk values. (Supplementary Note 2) The internal crime detection device according to Supplementary Note 1, wherein the trend determination unit compares the trend of the risk values ​​with a threshold, and determines that an inside crime has been committed by the user if the trend of the risk values ​​is equal to or greater than the threshold. (Supplementary Note 3) The internal crime detection device according to Supplementary Note 1 or Supplementary Note 2, wherein the trend determination unit, when determining that an inside crime has been committed by the user, outputs an alert generation flag that warns of an inside crime by the user, and the internal crime detection device, when acquiring the alert generation flag, generates a detection alert that warns of an inside crime by the user, and outputs the detection alert. (Supplementary Note 4) The user environment is an environment in which a security measure is implemented that analyzes the user's normal behavior using machine learning technology to generate a normal model and detects fraud by the user using the normal model, and the internal crime detection device includes a relearning flag generation unit that detects the occurrence of relearning of the normal model and generates a relearning flag that notifies the occurrence of the relearning, and the risk value calculation unit calculates the risk value upon receiving the relearning flag. (Supplementary Note 5) The internal crime detection device of Supplementary Note 4, wherein the internal crime by the user is a model contamination attack that relearns fraudulent activity as normal during the relearning, thereby polluting the normal model. (Supplementary Note 6) The internal crime detection device of Supplementary Note 4 or Supplementary Note 5, wherein the security measure is a measure that uses UEBA (User and Entity Behavior Analytics), and the normal model is a UEBA model.(Supplementary Note 7) An internal crime detection method, in which a computer acquires a user's operation log in a user environment, and calculates a risk value representing a security risk to the user, the computer associates the risk value with date and time information and stores the risk value in a risk value database, the computer acquires risk values ​​for a certain period of time from the risk values ​​stored in the risk value database, calculates a trend in the risk values ​​for the certain period of time, and determines whether or not an internal crime has been committed by the user based on the trend in the risk values. (Supplementary Note 8) An internal crime detection program that causes a computer to execute the following steps: a risk value calculation process that acquires a user's operation log in a user environment, and calculates a risk value representing a security risk to the user, a risk value storage process that associates the risk value with date and time information and stores the risk value in a risk value database, and a trend determination process that acquires risk values ​​for a certain period of time from the risk values ​​stored in the risk value database, calculates the trend in the risk values ​​for the certain period of time, and determines whether or not an internal crime has been committed by the user based on the trend in the risk values.

[0058] 31 Re-learning flag, 32 Risk value trend, 33 Alert generation flag, 34 Detection alert, 51 Operation log, 52 Risk value database, 53 Threshold, 100 Internal crime detection device, 110 Monitoring unit, 111 User environment monitoring unit, 112 Operation log extraction unit, 113 Re-learning flag generation unit, 120 Risk value processing unit, 121 Risk value calculation unit, 122 Risk value storage unit, 123 Trend determination unit, 124 Alert generation unit, 150 Storage unit, 200 User environment, 210 Security measures, 909 Electronic circuit, 910 Processor, 921 Memory, 922 Auxiliary storage device, 930 Input interface, 940 Output interface, 950 Communication device.

Claims

1. An internal crime detection device comprising: a risk value calculation unit that acquires a user's operation log in the user environment and calculates a risk value that represents the security risk for the user; a risk value storage unit that associates the risk value with date and time information and stores it in a risk value database; and a trend determination unit that acquires risk values ​​for a certain period from the risk values ​​stored in the risk value database, calculates the trend of the risk values ​​for the certain period, and determines whether or not an internal crime has been committed by the user based on the trend of the risk values.

2. The internal crime detection device of claim 1, wherein the trend determination unit compares the trend of the risk value with a threshold value, and if the trend of the risk value is greater than or equal to the threshold value, determines that an internal crime has occurred by the user.

3. The internal crime detection device described in claim 1 or claim 2, wherein the trend determination unit, when determining that an internal crime has been committed by the user, outputs an alert generation flag to warn of an internal crime committed by the user, and the internal crime detection device, when acquiring the alert generation flag, generates a detection alert to warn of an internal crime committed by the user and outputs the detection alert.

4. The user environment is an environment in which security measures are implemented that analyze the user's normal behavior using machine learning technology to generate a normal model and use the normal model to detect fraud by the user, the internal crime detection device includes a relearning flag generation unit that detects the occurrence of relearning of the normal model and generates a relearning flag that notifies the occurrence of the relearning, and the risk value calculation unit calculates the risk value when it receives the relearning flag. An internal crime detection device as described in any one of claims 1 to 3.

5. An internal crime detection device according to claim 4, wherein the internal crime committed by the user is a model contamination attack that contaminates the normal model by re-training fraudulent activity as normal during the re-learning.

6. The internal crime detection device according to claim 4 or 5, wherein the security measures are measures using UEBA (User and Entity Behavior Analytics), and the normal model is a UEBA model.

7. An internal crime detection method in which a computer acquires a user's operation log in the user's environment, calculates a risk value representing the security risk of the user, associates the risk value with date and time information and stores it in a risk value database, acquires risk values ​​for a certain period from the risk values ​​stored in the risk value database, calculates the trend of the risk values ​​for the certain period, and determines whether or not an internal crime has been committed by the user based on the trend of the risk values.

8. An internal crime detection program that causes a computer to execute the following processes: a risk value calculation process that acquires a user's operation log in the user environment and calculates a risk value that represents the security risk for the user; a risk value storage process that associates the risk value with date and time information and stores it in a risk value database; and a trend determination process that acquires risk values ​​for a certain period from the risk values ​​stored in the risk value database, calculates the trend of risk values ​​for the certain period, and determines whether or not an internal crime has been committed by the user based on the trend of the risk values.

Images